Identifying active code sections via memory forensics

A processing circuitry-based method of identifying an executed code section of a software process, the method comprising:

• a. accessing a memory space of a first process executing in an operating environment;
• b. identifying, from contents of the memory space, a software framework of the first process;
• c. finding, in the memory space, based on the software framework, a first code section description structure;
• d. identifying, from the first code section description structure, a code section execution indicator (CSEI) associated with a first code section;
• and
• e. determining, based on a value of the CSEI, whether the first code section has been executed.

A computer program product comprising a non-transitory computer readable storage medium containing program instructions, which when read by a processor, cause the processor to perform a method of identifying an executed code section of a software process, the method comprising:

• a. accessing a memory space of a first process executing in an operating environment;
• b. identifying, from contents of the memory space, a software framework of the first process;
• c. finding, in the memory space, based on the software framework, a first code section description structure;
• d. identifying, from the first code section description structure, a code section execution indicator (CSEI) associated with a first code section;
• and
• e. determining, based on a value of the CSEI, whether the first code section has been executed.