I have a memory dump of notepad.exe. Radare's
iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I can tell are the memory pages mapped out by the program to form the heap. Radare gives the permissions of these pages but not the flags they were created with, in particular if they are shared or private, reserved or committed, file backed or anonymous, etc. I assume working memory will generally be anonymous and private anyway, but I am working in the context of malware analysis, so nothing can be taken from granted.
How can I find the specific type that a particular memory mapping is? Can this be done statically, or will I need to emulate the memory dump somehow?