## 1 Introduction  
DLL injection is a common attack technique of malware, and a series of new variants have been developed. Different from previous DLL injection methods, the new DLL injection method prevents the victim process from calling the system API to load the malicious DLL module so that there is no information about the injected DLL in the LDR list of the victim process. Meanwhile, the new DLL injection method may tamper with the properties of the Virtual Address Descriptor (VAD), realizing the covert injection of malicious DLL modules. Driver-level injection is difficult to implement because Windows requires drivers to have trusted signatures, so the main target of the new DLL injection is the user-space process, and the injection method is more complicated and hidden. The representative injection methods include the reflective code inject technology proposed by [PERSON] et al. [1], the Process Hollowing technology proposed by [PERSON] et al. [2], and the VAD remapping technology proposed by [PERSON] et al. [3]. Moreover, some malware uses similar attack techniques, such as Duqu2.0 (2015), Dyre banking Trojan (2015), Conti ransomware (2020), etc., which cause widespread and serious harm [4], so the detection of new types of DLL injection is very important. Existing security software uses static and dynamic detection techniques and focuses on the detection of disk files and the process of injection, but the software has insufficient detection capability for malicious DLLs in memory after an attack occurs. Detection technology based on memory forensics can solve this problem. Memory forensics can find, extract, and analyze volatile evidence from physical memory and page swap files, and focuses more on the traceability of attacks after they occur. However, the existing memory forensics methods only consider the memory management structure in the virtual memory space, and these methods may be ineffective when the malware tampers with the memory management structure. For example, the VAD remapping method proposed by [PERSON] et al. [3] can modify the protection attribute and address range of VAD so that the VAD node corresponding to the malicious code page is associated with the benign page. The malfind plugin of Volatility relies on the VAD attribute for detection, so it cannot detect VAD remapping attacks. [PERSON] et al. [5] proposed a method based on the combined detection of the thread call stack and VAD attributes, but the method cannot detect injected code modules that do not trigger execution. [PERSON] et al. [6] proposed a method to detect hidden executable pages based on PTE attributes. Though the method can detect a variety of new injection attacks, it causes too many false-positive pages, making it difficult to accurately locate malicious memory pages. This paper proposes a code injection covert memory page detection and forensic algorithm named MRCIF (Memory Reverse based Code Injection Forensics). First, the physical memory pages containing DLL features from the memory image are located, and a sub-algorithm for mapping physical memory space and virtual memory space is designed, thus realizing reverse reconstruction of the physical page subset corresponding to the DLL code module. Then, in the virtual memory space, the LDR linked list structure of the process is reversely reconstructed, and a reverse reconstruction algorithm of the DLL virtual page subset is developed to reconstruct its virtual space. Finally, a DLL injection covert page detection sub-algorithm is designed based on the physical memory page subset and virtual space page subset. The experimental results indicate that MRCIF achieves a higher accuracy than that of the traditional DLL module injection detection method, and only MRCIF can accurately detect the VAD remapping attack. In practice, MRCIF helps to quickly determine the direction of investigation for forensic analysis because of its higher accuracy. The rest of this paper is organized as follows.