0

I'm having a tough time finding any information at all concerning physical memory addresses and if/how I can get them from a program at runtime (Windows NT/10). When I run a program in OllyDbg and I'm at a breakpoint, for example, are the memory addresses in the dump, disassembler window, and memory map physical addresses or are these actually still virtual addresses? Do user-mode programs even have any concept of the physical memory or is this only between the kernel and the MMU? Thanks.

Improve this question

1 Answer 1

Reset to default
3

Please note this mapping is by no means trivial, but there are several resources available:

INFOSEC INSTITUTE - Translating Virtual to Physical Address on Windows: Physical Addresses

Translating Virtual to Physical Address on Windows: Segmentation (more theoretical view)

Using WinDBG

Stack Overflow: How to translate a virtual memory address to a physical address?

I'm sure you're able to come up with many more sources. Basically, you must use the directory table to map virtual address pages to physical ones. You can find it using the C3 register or traversing the EPROCESS structure.

Please note that there is no concept for physical addresses at user space, because the ability to write and read from these addresses would give the application the possibility to own the system.

Improve this answer
5
  • Got it, so this means ALL addresses that are visible in OllyDbg or IDA, for example, are actually virtual addresses, not physical addresses?
    – the_endian
    Mar 8, 2017 at 10:00
  • Basically tools can calculate them and some do, but since they seldomly have any purpose, tools like OllyDbg and others display only virtual addresses
    – Nordwald
    Mar 8, 2017 at 10:02
  • Ahhh that makes sense. I was confusing virtual addresses in memory with the "dummy" addresses that are displayed when the program is on disk. I forgot the official name for these but they are basically addresses just used as reference while the program is not yet in memory for disassembly purposes and once it's loaded, the addresses could change to wherever the loader places them, but what I've learned from you is that even still, the addresses will be shown as virtual addresses.
    – the_endian
    Mar 8, 2017 at 10:05
  • Ah you are talking about the file offset (also called RVA). The RVA is basically the Virtual address with the image base substracted.
    – Nordwald
    Mar 8, 2017 at 10:08
  • Yes, I assume the disassemblers just use the preferred image base as default for this. Anyways thanks those resources were extremely helpful in learning about virtual memory vs physical memory further. I'm going to have to calculate some physical memory now 🙂
    – the_endian
    Mar 8, 2017 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.