Private Memory and
Image-backed Memory and
VAD

So far we have talked about RW → RX

What does this Memory even belong to?
When you examine a process, not all the memory you see is the same

To analyze memory-based behavior, we need to know how each region is built and what its relationship is to the file on disk

Image-backed Memory

When a PE such as:

notepad.exe

ntdll.dll

kernel32.dll

is placed inside the process, parts of the Virtual Address Space are linked to an Image File on disk

Conceptually:

PE File
│
▼
Image Mapping
│
▼
Process Virtual Address Space

For example, an Executable may have sections like this:

notepad.exe
├── .text
├── .rdata
├── .data
└── ...

In memory, these sections are usually linked to the Image related to the same Module, so when a Region is of the Image type, one of the important questions is:

Which Module on disk does this Region relate to?

Private Memory

Another type of memory is created as Private

This memory is not directly mapped to an image from the PE file. For example, a process may use Private Memory for various purposes:

Process
│
├── Image-backed Memory
│
└── Private Memory
├── Heap
├── Runtime Data
├── Temporary Allocations
└── Other Private Allocations

Important note:

Private Memory ≠ Malware

Completely legitimate programs use Private Memory all the time

So just seeing

Type = Private

doesn't prove anything

So why is Private Memory important for security analysis?

Because we need to examine several features together

For example:

Private Memory
+
Executable Permission
+
Unusual Thread
+
Unexpected Call Stack

Each one can be completely normal on its own

But when several Evidences are put together, the Investigation value increases

For example, a Region:

Private
RX`

Alone does not say:

Malicious

But it can be a good point for further investigation

The analyst should examine the Context

VAD
Now we come to VAD

Virtual Address Descriptor

VAD is one of the internal structures

Windows

to describe the limits of a Virtual Address Space Process

Conceptually:

Process Virtual Address Space

0x0000
│
├── Region A
├── Region B
├── Region C
├── Region D
└── ...

0xFFFF

VADs help the Kernel manage and describe information
regarding the Virtual Memory limits of a Process

For example, that a Where is the region and what are its properties

Memory Region
Not just an Address
Suppose you see something like this in Debugger or Memory Analysis:

Address: 0x7...
Size: 0x...
Protection: RX
Type: Private

If you only see the Address, you will miss a lot of information

You should ask a few questions:

Where is this Region?
↓
How big is it?
↓
What is its Protection?
↓
Private
Is it an Octal or an Image?
↓
What Mapping or Allocation does it belong to?
↓
What Threads are accessing or executing it?
↓
What happened to it over time?

Here Memory Analysis goes from looking at a few Hex Values ​​to Behavioral Analysis

VAD in Memory Forensics

In Memory Forensics we can examine the Virtual Memory structures related to the Process

Conceptually:

Process
│
├── Image
│
├── .text
│
└── .data
│
├── DLLs
│
├── Heap
│
└── Private Regions

Now suppose we find a Region that needs further investigation

We can ask:

What is the Protection?
↓
Is it Private or Image?
↓
Is it associated with a known Module?
↓
What does its content look like?
↓
Is there a Thread associated with it
↓
What does the Call Stack show?
↓
Has the Region's state changed over time?

The important point is that VAD alone does not answer all these questions

VAD is one of the sources of evidence in memory analysis

Analysis scenario
Suppose we have this situation in a memory dump:

Process: example.exe

Region A
Image
RX

Region B
Private
RW

Region C
Private
RX

Region A looks very normal

Because it is related to an image and its permission is expected for executing code