@j3s sometimes you can catch it in /dev/kmem or /proc/kcore