Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
2
votes
0answers
31 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
1
vote
1answer
44 views

How can I find out the size of heap allocations?

While I debug with GDB I see the address of a buffer that's located on the heap. How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated? When I ...
4
votes
1answer
85 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
3
votes
1answer
82 views

How is lite hash rate (LHR) of Nvidia implemented?

Nvidia limited some of their GPUs with LHR to decrease the performance of Ethereum mining. What in detail is LHR doing? It seems to limit non sequential memory operations (which is actually not what ...
0
votes
0answers
27 views

Question About Buffer Overflow And NOP Sled

I am trying to learn buffer overflow but I have a question about one CTF. In "Buffer Overflows" CTF in Tryhackme, while creating the payload, I can use '0x7fffffffe388' or '0x7fffffffe398' ...
0
votes
2answers
64 views

Not Understanding the FU540 Boot Process

I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on. I'm using MSEL = 1111 based on the recommendation ...
0
votes
0answers
23 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
0
votes
0answers
28 views

Hardware Breakpoint wont work on address created during runtime

I am currently trying to crack a crackme.exe. Before the jump, it compares the following (0 == not registered): cmp byte ptr ds:[eax+0x15FC], 0x0 If I normally load the .exe and try to go to the ...
1
vote
1answer
88 views

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

I am trying to understand the usage of calls to CC_MD5 in an iOS application. From Apple's man page I can see that when it is called it requires 3 arguments: extern unsigned char * CC_MD5(const void *...
0
votes
1answer
74 views

How can I get the correct offset from that instruction?

I have the following instructions: The registers' values in the First instruction are: RAX=0000000033307EE0 RCX=0000000000000000 The registers' values in the Second instruction are: RAX=...
1
vote
1answer
123 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
0
votes
0answers
100 views

How can I get a value from a memory address that changes almost every millisecond?

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond. ScreenShot: I did a hardware ...
0
votes
0answers
41 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
1
vote
1answer
67 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
0
votes
0answers
58 views

IDA help me understand these operations on the memory

I have a stripped binary, which I want to reverse engineer. I spent quite some time with it, and dug myself through most of it, however, I got stuck near these lines. Context: the program has 5 local ...
0
votes
1answer
650 views

In x64dbg, how to set software breakpoint on specific memory address?

This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg. In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
-1
votes
2answers
145 views

How does cheat engine's "dissect data structures" work?

In Cheat Engine there is function for analyse memory. The result of this analysis is types of memory bytes. I can't understand the algorithm of this analysis. How can it define that these bytes are ...
0
votes
0answers
232 views

Replacing a memory block in Ghidra

I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't ...
0
votes
1answer
52 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
1
vote
0answers
24 views

API-Monitor not logging buffer

I have a problem with API-Monitor. When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
0
votes
1answer
41 views

error shmat function when simulating MIPS file in Qemu

I want to run (simulating) MIPS file with Qemu: $file httpd httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ...
0
votes
1answer
116 views

What is copy_block struct in Tricore Arch?

Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below: ld32.w d4, [a0]-0x68D4 I know a0 = 0xD00032E0 but ...
0
votes
1answer
27 views

How can a debugger break on dynamic loaded libraries?

I think I have a massive understanding problem with the following issue: Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
0
votes
1answer
124 views

How does radare2 create its memory layout?

Firstly Hello, this is my first post on this forum even though im reading alot here. Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here. I did read ...
1
vote
2answers
564 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
0answers
39 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
-3
votes
1answer
268 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
1
vote
1answer
120 views

Rust string capacity lower than string lenght

According to RUST documentation, strings are stored this way : This is a statement I can verify while reversing rust binaries. The thing is that when I am reversing rust binaries, I likely encounter ...
0
votes
0answers
51 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
1
vote
0answers
30 views

WinDbg pattern search not returning expected result

I'm searching for a string, say the old "This program cannot run". Switching context to e.g. notepad, non invasive, with page translation 1: kd> !process 0 0 notepad.exe PROCESS ...
1
vote
0answers
61 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
41 views

WinHex : There's a data that does not belong to any module

I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data). Now , when i open the process Entire memory with in WinHex , i can ...
1
vote
0answers
153 views

Subaru Eyesight Images and collision avoidance systems

I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
0
votes
1answer
79 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
1answer
97 views

What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?

So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
1
vote
0answers
55 views

Can i dump dll from pagefile?

Like the title of this question, im trying to dump dll of process but it only return a message Error: Dllbase is paged (pic below) So is the dll on pagefile and can i extract it from pagefile.sys ? ...
4
votes
1answer
157 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
-1
votes
1answer
441 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
0
votes
2answers
293 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
1
vote
2answers
431 views

Byte-patch a JMP

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
1
vote
1answer
73 views

Executable code in the same location differs in memory and on disk

I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
1
vote
0answers
160 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
-1
votes
1answer
131 views

How do I view the call stack of an executable?

Basically I'm trying to edit memory (replace branch with a nop so the executable can't branch to auth function). I've done successful reverse engineering on gaming consoles, but I don't really know ...
0
votes
1answer
131 views

Manufacturer interface on OCZ Agility 4 SSD

Inside the housing of an OCZ Agility 4 SSD I found several additional connectors on the opposite site of the SATA connectors. What are they good for and how to connect them properly? Zoomed:
0
votes
2answers
244 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
2
votes
2answers
369 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
0
votes
1answer
106 views

Can a program's memory be dumped and then reinserted?

Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
3
votes
1answer
305 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
0
votes
1answer
3k views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
2
votes
1answer
405 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)

1
2 3 4 5