0

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 bytes, which is 4G RAM. But I have 16G RAM, which is 17179869184 bytes, which needs 9 digits not 8

This is part of the assembly as radare2 views:

0x004011d0      750e           jne 0x4011e0
0x004011d2      488d3d410e00.  lea rdi, str.Acess_granted  ; 0x40201a ; "Acess granted!" ; const char *s

I think I misunderstand something here, can someone clarify? Thanks in advance.

  • 32 bits programs can't allocate beyond 4G of memory, are you on 32x architecture ? – Abr001am May 20 at 6:13
6

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has virtual memory space covering possibly the entire address space but mapped to a limited section of physical memory. Even on a 64-bit system where there are theoretically 2^64 bytes (an unrealistic 16 exibytes) of mappable addresses, you can still have a system with under 1GB of RAM and still have access to the virtual address space (which is much less than 2^64 in reality but still possibly larger than your physical RAM).

What you are seeing in radare (0x004011d0) are addresses within the executable itself, and are still 64-bit but leading zeros are often omitted in various tools for convenience (actual address is 0x00000000004011d0). While they are mapped into the process's virtual memory table, those addresses are actually burned into the executable at compile time (unless it is compiled with PIE). Those addresses are usually around that general area and are typically the lowest section of virtual memory.

If you want to see your 64-bit address space at work, look at pointers in registers and on the stack (or the stack addresses themselves), which will be much larger.

| improve this answer | |
  • 64/86x friendly programs can allocate more than 4G dynamically, while 32x programs can't work on more than 4G either dynamically or statically. – Abr001am May 20 at 6:16
  • 1
    @Abr001am unless PAX is involved, which gives x86 more room – multithr3at3d May 20 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.