All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
1answer
49 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
40 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
0
votes
0answers
44 views

Frida: Make executable immune to updates

I have few questions which are related to each other so I'm going to ask all of them here. I have a dll which has no debug symbols(ASLR and relocation is disabled). The functions have names like ...
1
vote
1answer
147 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
1
vote
0answers
71 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
0
votes
1answer
193 views

how do I define an address with a module and an offset in c++

I'm trying to define an address so that I can edit its memory later, however I can't figure out a way to access it. The base address is "program.exe"+00D23440 and has an offset of +30 Normally you ...
1
vote
1answer
2k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
2
votes
1answer
216 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
3
votes
2answers
2k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
3
votes
2answers
393 views

0x09-0x0d not taken into account with scanf

I've encountered something I can't explain. Here is the problem #include <stdio.h> #include <string.h> #include <stdlib.h> void ask() { char name[64]; printf("What is your ...
2
votes
3answers
908 views

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function ...
2
votes
2answers
545 views

Redirecting/Remapping/Rerouting a Memory Access

I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub: .text:008EC420 ; ...
2
votes
1answer
1k views

How to find memory addresses which are read from but not written to

Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses... Is there any such functionality in IDA ...