Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
Pg. 07
Boot PersistenceBoot PersistenceBoot
Persistence
8. Memory Allocation for DLLs and AXEs
For loading DLLs and AXEs, the loader is free to make calls to VirtualAlloc(), VirtualProtect(),
VirtualQuery() and VirtualFree(). Memory allocated by these mechanisms would be paged out
to pagefile.sys during the memory manager’s page eviction process. These pages would also
be compressed and saved to the hibernation file when a laptop is hibernated or a desktop goes
to hybrid sleep. In addition the memory would be available in physical memory captures of the
system and can be examined by forensic tools like volatility. Aditionally live forensic tools like
SysInternals VMMap will list all memory regions allocated by calls to VirtualAlloc() including the
memory allocated for storing target DLLs and AXEs.