Detecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries

## Overview

The presentation addresses methods for uncovering hidden, injected, or modified code within memory by directly analyzing paging mechanisms and memory structures. In modern operating systems like Windows, code injection and process manipulation techniques frequently alter memory protections—such as switching pages between readable, writable, and executable states. By inspecting lower-level structures rather than relying strictly on high-level operating system APIs, investigators can identify discrepancies and pinpoint modified or relocated memory pages.

## Paging Structures and Page Table Entry (PTE) Analysis

A core focus of the methodology involves tracing virtual address resolution down to hardware paging tables and inspecting specific Page Table Entries (PTEs):

- **PTE States and Prototypes:** The talk details evaluating paging structures, including handling different states of PTEs and prototype PTEs (`prototype PTEs` / `subsections`). These structures reflect how the memory manager maps, shares, or alters backing pages. - **Protection and Flag Tracking:** Analysis looks at bit-level flags within PTE structures, such as execution permissions and the NX (No-Execute) bit. Transitions—such as modifying the NX bit or toggling protections to read/write/execute—serve as strong indicators of memory manipulation. - **Identifying Modified vs. File-Backed Pages:** The workflow compares current in-memory content against original backing files on disk (e.g., mapped image files/PE sections). Inspecting underlying paging structures allows detection of modified pages that deviate from their clean on-disk representations, even when operating system structures attempt to conceal these deviations.

## Memory Forensics, Tooling, and Plugin Detection

To automate and streamline the detection process, specialized forensic inspection tools and plugins are utilized:

- **Memory Analysis Plugins:** The talk highlights the use of forensic plugins (such as custom or Volatility-style inspection plugins) designed to scan address spaces and report anomalous memory regions. - **Visual and Structural Indicators:** Forensic outputs categorize pages based on protection states, highlighting suspicious sections (e.g., transitions to executable memory, unexpected read-write-execute permissions, or empty spaces interspersed with active modifications). - **Evaluating Inconsistencies:** The approach flags conditions where page protection metadata contradicts the expected operational profile—such as unexpected executable pages or altered pointers pointing to recycled or relocated memory regions.

## Takeaways and Forensic Implications

- **Bypassing High-Level Evasion:** Malware frequently evades basic user-mode hooks or standard memory scanning by manipulating memory management structures. Direct examination of PTEs and paging flags exposes changes that higher-level APIs might normalize or mask. - **Investigative Efficiency:** Forensic examiners can prioritize triage by narrowing down large memory spaces to specific altered pages, focusing on entries where execution privileges (NX bit alterations) or page prototype mappings have been tampered with. - **Combined System Checks:** Integrating PTE verification into broader automated forensic pipelines enhances the capability to detect stealthy in-memory persistence and live process injections.