Memory Analysis - VAD Tags and Code Entry

Question

I am doing research in the field of forensics in memory, and currently I need to learn how to find code injections in memory in several ways. One way is to use VAD tags to enter the code.

I tried to figure out what VAD is and what VAD tags are, but I just could not find a simple simple explanation. The only thing I understand is that VAD is some kind of win32 structure, and it has something to do with the process address space. But I don’t understand what exactly VAD does, how you use it to enter code, and how you can detect code injections in RAM that use VAD tags.

I would be grateful if you could guide me through this. Thanks:)

Answer 1

VAD stands for virtual address descriptor. It would seem that the Windows kernel organizes the memory allocated by the process (or the kernel?) By the tree of allocated VAD distributions.

I found a project that apparently implements the criminalization of memory and references a document that seems to describe VAD pretty well. Now I am on my mobile phone, so I have not read it completely, but it looks like a promising resource.

The project is called volatility .

They cite an article entitled "VAD Tree: A Look Overlooking Physical Memory" by Brendan Dolan-Gavitta .

Answer 2

, VAD. .

VAD , .

* . PTE, , .

VAD , AVL, , Sysnative. *