Why doesn't memmap tally with vadinfo?
by Bridgey theGeek
Hi all,
System is Win7SP1x86.
pagefile is OFF.
Consider this VAD node (from vadinfo):
VAD node @ 0x85e076d0 Start 0x76440000 End 0x764dffff Tag Vad
Flags: CommitCharge: 5, Protection: 7, VadType: 2
Protection: PAGE_EXECUTE_WRITECOPY
Vad Type: VadImageMap
ControlArea @853ab1e0 Segment 8f6eba98
NumberOfSectionReferences: 1 NumberOfPfnReferences: 120
NumberOfMappedViews: 32 NumberOfUserReferences: 33
Control Flags: Accessed: 1, File: 1, Image: 1
FileObject @853ab898, Name:
\Device\HarddiskVolume1\Windows\System32\advapi32.dll
First prototype PTE: 8f6ebac8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1
My understanding is that this VAD node is tracking the pages from
0x76440000 through to 0x764dffff.
When I look at the output of memmap for this process and this range I see:
--SNIP--
0x76228000 0x1f04c000 0x1000 0x2c1000
0x76440000 0x20670000 0x1000 0x2c2000 <-- start
0x76441000 0x0b728000 0x1000 0x2c3000
0x76451000 0x233a8000 0x1000 0x2c4000
0x76454000 0x1f5ab000 0x1000 0x2c5000
0x76455000 0x2336c000 0x1000 0x2c6000
0x76456000 0x1f6ed000 0x1000 0x2c7000
0x76457000 0x1f6ae000 0x1000 0x2c8000
0x76458000 0x2346f000 0x1000 0x2c9000
0x76459000 0x1e48b000 0x1000 0x2ca000
0x7645a000 0x21fcc000 0x1000 0x2cb000
0x7645b000 0x223cd000 0x1000 0x2cc000
0x76460000 0x1e3d2000 0x1000 0x2cd000
0x76461000 0x1e103000 0x1000 0x2ce000
0x764af000 0x20636000 0x1000 0x2cf000
0x764b1000 0x23ef8000 0x1000 0x2d0000
0x764b3000 0x0bded000 0x1000 0x2d1000
0x764b7000 0x1f730000 0x1000 0x2d2000
0x764e0000 0x208e6000 0x1000 0x2d3000 <-- first byte after end
--SNIP--
The file itself, advapi32.dll, is 0xa0000 bytes (well, in memory).
dlllist shows:
Base Size LoadCount Path
---------- ---------- ---------- ----
0x76440000 0xa0000 0xffff C:\Windows\system32\ADVAPI32.dll
0x76440000 through to 0x764dffff is 0x9FFFF bytes long.
However, memmap is only showing 0x13000 bytes.
The 0x13000 isn't big enough to hold the 0xa0000 bytes of the file.
My question is, why isn't the whole range (0x76440000 through to
0x764dffff) shown in memmap?
Is it the case that the VAD node is responsible for the whole range, but
simply not all the pages in that range are in use which is why they're
missing from the memmap output?
Or is there something that I'm missing?
Any comments greatly appreciated!
Adam
8 years, 7 months
- 2
- 1
Volatility at Black Hat!
by Andrew Case
The Volatility team will be participating in a number of events at Black
Hat this year, and we hope to see many of you there.
This includes a book signing, arsenal demo, and even a party!
Full information can be found here:
http://volatility-labs.blogspot.com/2015/07/volatility-at-black-hat-usa-dfr…
Please let us know if you have any questions, and we look forward to
seeing many of you in Vegas!
--
Thanks,
Andrew (@attrc)
8 years, 10 months
- 1
- 0