Learning Malware Analysis

1.1 Getting VAD Information

To get VAD information from the memory image, you can use the vadinfo Volatility plugin. In the following example, vadinfo is used to display the memory regions of an explorer.exe process using its process ID (pid 2180). In the following output, the first VAD node at address 0x8724d718 in the kernel memory describes the memory range 0x00db0000-0x0102ffff in the process memory and its memory protection PAGE_EXECUTE_WRITECOPY. Since the first node is describing a memory range containing a memory-mapped executable image (explorer.exe), it also gives its full path on the disk. The second node, 0x8723fb50, describes a memory range of 0x004b0000-0x004effff, which does not contain any memory mapped file. Similarly, the ...