Module pagefile

source code

This file adds pagefile support.

Although much of the address translation machinery occurs in hardware, when a page fault occurs the operating system's pager is called. The pager is responsible for faulting in invalid pages, and hence we need operating system specific support.

Rekall's base paging address spaces emulate the hardware's MMU page translation, but when the page is invalid Rekall emulates the operating system's page fault handling code. The correct (OS dependent) address space is selected in rekall.plugins.core.FindDTB.GetAddressSpaceImplementation() based on the profile metadata.

This file implements the algorithms described in the paper:

Forensic Analysis of Windows User space Applications through Heap allocations. Michael Cohen, 3rd IEEE International Workshop on Security and Forensics in Communication Systems 2015 [1]

http://www.rekall-forensic.com/docs/References/Papers/p1138-cohen.pdf