VAD: A Detail Investigation into Process´s Memory

This paper discusses a process´ s memory layout on Windows. We describe the structures of the Virtual Address Descriptor (VAD) and AVL tree of VADs in Windows Research kernel (WRK), and how to extract useful information from these structures, and how to locate process heaps using PEB. We recommend a way to get process´ s memory layout in user space using VAD tree traverse on WRK, which is illustrated by one full example. We also present that how to reserve, commit and release memory.