This document presents insights from extensive reverse engineering efforts of the memory management mechanisms of Windows XP. The focus lies on the mechanisms which are used to map executable modules into the address space and the role of the page fault handler in this context.




File list:
Internals of Windows Memory Management for Malware Analysis
..........................................................\Internals of Windows Memory Management for Malware Analysis.pdf