O'Reilly logo

Learning Malware Analysis by Monnappa K A

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

1.2 Detecting Injected Code Using VAD

An important point to note is that when an executable image (such as EXE or DLL) is normally loaded into the memory, that memory region is given a memory protection of PAGE_EXECUTE_WRITECOPY(WCX) by the operating system. An application is generally not allowed to allocate a memory with PAGE_EXECUTE_WRITECOPY protection using an API call such as VirtualAllocEx. In other words, if an attacker wants to inject a PE file (such as EXE or DLL) or shellcode, then a memory with a PAGE_EXECUTE_READWRITE(RWX) protection needs be allocated. Normally, you will see that very few memory ranges have a memory protection of PAGE_EXECUTE_READWRITE. A memory range having a protection of PAGE_EXECUTE_READWRITE is not always ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required