I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium.github.io/blog/posts/windows-full-memory-introspection-with-icebox/ https://cyberforensicator.com/wp-content/uploads/2017/08/Scanning-memory-with-Yara.pdf https://www.sciencedirect.com/science/article/pii/S1742287619301574
None of them explain when a PTE is actually of the VAD prototype format.
Seeing as PPTEs are created when the section object is created for images, and for data files the PPTEs are created when the view is mapped (which is when the VAD entry is created) [1], I can't see a case where the PTEs in the VAD allocation would ever not be able to point directly to the prototype PTEs.
If the PPTEs weren't created once the view is mapped, it would make sense to be a VAD type, because there is no PPTE virtual address to point to, but this is not the case. From now on, there is always a PPTE virtual address to point to. The PPTE itself will point to a subsection object (_MMPTE_SUBSECTION format) in the event that it is a file-backed and not in RAM, and point to a pagefile location if it is pagefile-backed and not in RAM.
I did some further investigation and noticed that the VAD prototype PTEs were all on mapped files, and mapped images had regular prototype pointer PTEs (which is strange because PPTEs are available when you map a view in the VAD in the case of data, and when the section object is created in the case of image, which is before the mapping of the view in the VAD). Also something strange I noticed is that CoW PTEs are blank when they are not pointing to a page in the file, as opposed to pointing to the PPTE. They need to point to a page in the file when they are read and before any writes occur. I'd like that to also be answered.
I have seen a case where more space has been reserved for a data file than the size of the file -- on VMMap it shows 16KiB committed and 512KiB reserved. The committed PTEs are VAD prototypes and the reserved ones are blank (unknown PTEs)
I previously asked this on SO, but obviously nobody replied, so I'm moving it to the correct forum. Before anyone tells me I should have debugged it before asking, this question will be number 1 in the search for 'VAD prototype PTE' and '0xFFFFFFFF0000' and so on, and people will be looking it up when those sources don't elaborate. There is no googlable information on this detail written in a human language, and I know I spent a good few hours on advanced and verbatim search, and it's a fundamental piece of information for people to know.
