Finding mapped memory page flags in Radare2

Question

I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I can tell are the memory pages mapped out by the program to form the heap. Radare gives the permissions of these pages but not the flags they were created with, in particular if they are shared or private, reserved or committed, file backed or anonymous, etc. I assume working memory will generally be anonymous and private anyway, but I am working in the context of malware analysis, so nothing can be taken from granted.

How can I find the specific type that a particular memory mapping is? Can this be done statically, or will I need to emulate the memory dump somehow?

Answer 1

use im to get the type and state

they are not deciphered like windbg can but you can get the flags

radare2

[0x7ff6c5153380]> im~0xcf39d2c000
0xcf39d2c000 +0x4000 rw- paddr=0x0000959e state=0x00001000 type=0x00020000 allocation_protect=0x00000004 Memory_Section
[0x7ff6c5153380]> iS~0xcf39d2c000
2   0x0000959e    0x4000 0xcf39d2c000      0x4000 -rw- Memory_Section_2
[0x7ff6c5153380]>       

windbg

0:003> !vprot cf`39d2c000
BaseAddress:       000000cf39d2c000
AllocationBase:    000000cf39cb0000
AllocationProtect: 00000004  PAGE_READWRITE
RegionSize:        0000000000004000
State:             00001000  MEM_COMMIT
Protect:           00000004  PAGE_READWRITE
Type:              00020000  MEM_PRIVATE

these are returned by calling VirtualQuery/Ex API 's

MEMORY_BASIC_INFORMATION

https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information