Tweeted twitter.com/#!/StackReverseEng/status/424257980646043648
2 added 9 characters in body; edited title
source | link

VAD's VADs with RWX permission in winlogon and csrss processes

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcorevboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VAD'sVADs with PAGE_EXECUTE_READWRITEPAGE_EXECUTE_READWRITE permissions in winlogon.exewinlogon.exe process and 1 VAD with the same permission in csrss.execsrss.exe process. Sometimes there is one in explorer.exeexplorer.exe process as well.

This is the same for two different Machines one with VirtualBox tools installed and one without.

Where do these come from? What are the write permission useful for? Any help is mostly appreciated, thank you!

VAD's with RWX permission in winlogon and csrss processes

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VAD's with PAGE_EXECUTE_READWRITE permissions in winlogon.exe process and 1 VAD with the same permission in csrss.exe process. Sometimes there is one in explorer.exe process as well.

This is the same for two different Machines one with VirtualBox tools installed and one without.

Where do these come from? What are the write permission useful for? Any help is mostly appreciated, thank you!

VADs with RWX permission in winlogon and csrss processes

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with PAGE_EXECUTE_READWRITE permissions in winlogon.exe process and 1 VAD with the same permission in csrss.exe process. Sometimes there is one in explorer.exe process as well.

This is the same for two different Machines one with VirtualBox tools installed and one without.

Where do these come from? What are the write permission useful for? Any help is mostly appreciated, thank you!

1
source | link

VAD's with RWX permission in winlogon and csrss processes

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VAD's with PAGE_EXECUTE_READWRITE permissions in winlogon.exe process and 1 VAD with the same permission in csrss.exe process. Sometimes there is one in explorer.exe process as well.

This is the same for two different Machines one with VirtualBox tools installed and one without.

Where do these come from? What are the write permission useful for? Any help is mostly appreciated, thank you!