Internals of Windows Memory Management for Malware Analysis

This document presents insights from extensive reverse engineering efforts of the memory management mechanisms of Windows XP. The focus lies on the mechanisms which are used to map executable modules into the address space and the role of the page fault handler in this context.