Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

2
votes
2answers
69 views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
0
votes
1answer
56 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
3
votes
1answer
90 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
1
vote
0answers
42 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
1
vote
0answers
40 views

How do I know where an Allwinner R16 CPU stores the firmware image in memory?

The manual for the R16 (aka A33) specifies where the NAND Controller is in its memory map, but doesn't specify at which memory address it will store the first byte of the firmware. How can I find it?
2
votes
1answer
165 views

What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?

I have a 64bit exe I'm debugging with x64dbg. I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing). ...
2
votes
1answer
138 views

Has there been any success in using deep learning for reverse engineering?

So has there been any success in using deep learning for doing reverse engineering? i couldn't find anything useful other than some theoretical papers, so was there any talk about this in recent ...
1
vote
1answer
98 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
1
vote
0answers
50 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
1
vote
1answer
117 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
2
votes
1answer
119 views

Does x64dbg display the whole memory info even for a simple program opened?

I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below. #include <stdio.h> void main() { int x, y, z; while(...
0
votes
0answers
90 views

Read SPI Flash memory blocks

I have device with embedded eCos RTOS and SPI Flash memory. Flash Device Information: CFI Compliant: no Command Set: Generic SPI Flash Device/Bus Width: x16 Little Word Endian: ...
1
vote
0answers
126 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
2
votes
0answers
28 views

Why is vdso remapped after setting stack space to unlimited?

On my Ubuntu 16.04, 64 bit the default stack size is 8192 bytes. If I set it to unlimited, seems like the vdso is remapped to a completely different memory region. $ ulimit -s 8192 $ cat /proc/`...
2
votes
1answer
196 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
-1
votes
1answer
157 views

Hooking flash player dll

Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. Do ...
2
votes
2answers
287 views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
0
votes
0answers
116 views

Dump flash memory data from old arcade board

I have a PCB used in a pinball machine. The PCB has a flash memory chip on it, which contains game code. When the PCB is plugged into a standard ISA slot of the game's Cyrix motherboard, data from the ...
0
votes
1answer
57 views

How do the new Swedish implantable microchips work?

So now we see that the Swedes are going large with their implantable chips which allow them to carry out certain kinds of transactions without using plastic. Thousands of people in Sweden get ...
1
vote
1answer
141 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
-1
votes
0answers
37 views

Save changed memory string statically to binary

I am a real noob when it comes to reverse engineering, so forgive me if this is either basic, stupid, or already answered and i just searched stupidly. I have a program which was not communicating ...
0
votes
1answer
153 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
1
vote
1answer
296 views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
0answers
167 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
-1
votes
0answers
68 views

Difference between memory segment and memory section

I wonder what's the actual difference between the two terms. I've been googling without success and depending on the bibliography authors tend to use either memory segment or memory section with no ...
1
vote
0answers
76 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
0
votes
1answer
141 views

Reversing C# exe,Questions.Help

I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second. I want to rewrite its dataseries before the new data comes with my own dataset. ...
-1
votes
0answers
66 views

Finding process offsets

I'm looking to find Offsets for Windows processes to hook in to and change in memory. What's the quickest way to go about this? I tried cheatengine, but unfortunately returns too many results to be ...
0
votes
1answer
86 views

Is it possible to (core-dump) recover a video in memory of the player (VLC) started without a debugger?

Essentially, I'm wondering how difficult or possible it would be to do a core-dump on an already running process that was started without a debugger. I have a video that I opened in VLC (and is still ...
2
votes
1answer
546 views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
3
votes
0answers
76 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
0
votes
2answers
144 views

Techniques for marking memory changes

i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory ...
4
votes
2answers
443 views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
8
votes
2answers
854 views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
1
vote
1answer
96 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
1
vote
1answer
2k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
1
vote
1answer
542 views

Find what writes to a dynamic memory address

I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
1
vote
2answers
161 views

How to monitor specific variables in a running process?

I would like to monitor, record, specific variables in an application but I am not sure what is the right way to approach this problem. The application is a mix of C(5%) and C++(95%) and it is ...
2
votes
1answer
211 views

How to find out which instruction wrote to a specific address?

I'm not an expert in reversing and even though Googling is usually enough, this time I can't find a solution. I have this program that calculates a value from some data it received from a server. I ...
1
vote
0answers
57 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
0
votes
0answers
101 views

OllyDbg doesn't separate memory sections

So i was casually hacking a minesweeper. I created a new section in PE file for my injected code, but as you can see in the following screenshot, ollydbg merged all original sections from PE file into ...
0
votes
1answer
4k views

Reverse engineering a golang binary file

I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
5
votes
0answers
92 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
1
vote
3answers
2k views

Reading Physical Memory

I am trying to determine how to read physical memory. I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a ...
8
votes
1answer
290 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
0
votes
1answer
118 views

how do I define an address with a module and an offset in c++

I'm trying to define an address so that I can edit its memory later, however I can't figure out a way to access it. The base address is "program.exe"+00D23440 and has an offset of +30 Normally you ...
2
votes
3answers
614 views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
2
votes
0answers
624 views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
1
vote
1answer
737 views

How does new operator internally work in C++?

The articles explaining the internals of malloc and free in glibc are abundant in number. However, I'd like to know how dynamic memory management works in C++, specifically the nitty gritty of new and ...
7
votes
2answers
4k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...