Why there are only 8 hexa memory digits while my RAM is 16G

Question

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 bytes, which is 4G RAM. But I have 16G RAM, which is 17179869184 bytes, which needs 9 digits not 8

This is part of the assembly as radare2 views:

0x004011d0      750e           jne 0x4011e0
0x004011d2      488d3d410e00.  lea rdi, str.Acess_granted  ; 0x40201a ; "Acess granted!" ; const char *s

I think I misunderstand something here, can someone clarify? Thanks in advance.

Answer 1

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has virtual memory space covering possibly the entire address space but mapped to a limited section of physical memory. Even on a 64-bit system where there are theoretically 2^64 bytes (an unrealistic 16 exibytes) of mappable addresses, you can still have a system with under 1GB of RAM and still have access to the virtual address space (which is much less than 2^64 in reality but still possibly larger than your physical RAM).

What you are seeing in radare (0x004011d0) are addresses within the executable itself, and are still 64-bit but leading zeros are often omitted in various tools for convenience (actual address is 0x00000000004011d0). While they are mapped into the process's virtual memory table, those addresses are actually burned into the executable at compile time (unless it is compiled with PIE). Those addresses are usually around that general area and are typically the lowest section of virtual memory.

If you want to see your 64-bit address space at work, look at pointers in registers and on the stack (or the stack addresses themselves), which will be much larger.