Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
237 views

What does this lowlevel function do?

I am currently reversing a game called Warframe and have gotten quite far. There is just one function which is really making me wanna give up. One hint I can give: The function was found IN another ...
user avatar
  • 1
0 votes
0 answers
16 views

Tool to Analyse Browser memory in Javascript console

By using the Inspector tool, we can access every object in the browser using the console. For example, if you go to Youtube.com and you open the console, and you type ytInitialData , you can see the ...
user avatar
  • 101
1 vote
1 answer
66 views

ARM - Understanding a "base address" when reversing firmware

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
user avatar
0 votes
0 answers
25 views

Volatility 2.x command missing in Volatility 3.x?

I am doing some memory analysis exercises with Volatility. Here, they used the command cmdscan in the Volatility 2.x framework to analyze executed commands from a windows command prompt. Sadly, I was ...
user avatar
  • 49
0 votes
1 answer
76 views

How to extract specific data from memory

I'm totally new to this reverse engineering stuff. I'm working on my own project and trying to parse poker games from PokerStars application. I have already done with injecting my DLL to the app, but ...
user avatar
0 votes
1 answer
48 views

Extract certificate information of a process from memory dump

I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried ...
user avatar
0 votes
0 answers
36 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
user avatar
1 vote
0 answers
42 views

ReadProcessMemory from host to Hyper-V Windows Guest VM

Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V? The host is running Windows 11 the Guest is running ...
user avatar
  • 11
1 vote
0 answers
46 views

Scraping data from an audio analyzer application

Briefly: I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start? ...
user avatar
1 vote
1 answer
177 views

How does Cheat Engine offset calculation work?

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number. IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C; /...
user avatar
  • 153
2 votes
0 answers
81 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
user avatar
  • 21
1 vote
1 answer
133 views

How can I find out the size of heap allocations?

While I debug with GDB I see the address of a buffer that's located on the heap. How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated? When I ...
user avatar
5 votes
1 answer
129 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
user avatar
3 votes
1 answer
217 views

How is lite hash rate (LHR) of Nvidia implemented?

Nvidia limited some of their GPUs with LHR to decrease the performance of Ethereum mining. What in detail is LHR doing? It seems to limit non sequential memory operations (which is actually not what ...
user avatar
0 votes
0 answers
51 views

Question About Buffer Overflow And NOP Sled

I am trying to learn buffer overflow but I have a question about one CTF. In "Buffer Overflows" CTF in Tryhackme, while creating the payload, I can use '0x7fffffffe388' or '0x7fffffffe398' ...
user avatar
  • 1
0 votes
2 answers
65 views

Not Understanding the FU540 Boot Process

I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on. I'm using MSEL = 1111 based on the recommendation ...
user avatar
0 votes
0 answers
51 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
user avatar
  • 101
0 votes
0 answers
30 views

Hardware Breakpoint wont work on address created during runtime

I am currently trying to crack a crackme.exe. Before the jump, it compares the following (0 == not registered): cmp byte ptr ds:[eax+0x15FC], 0x0 If I normally load the .exe and try to go to the ...
user avatar
1 vote
1 answer
168 views

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

I am trying to understand the usage of calls to CC_MD5 in an iOS application. From Apple's man page I can see that when it is called it requires 3 arguments: extern unsigned char * CC_MD5(const void *...
user avatar
  • 95
0 votes
1 answer
105 views

How can I get the correct offset from that instruction?

I have the following instructions: The registers' values in the First instruction are: RAX=0000000033307EE0 RCX=0000000000000000 The registers' values in the Second instruction are: RAX=...
user avatar
  • 125
1 vote
1 answer
145 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
user avatar
  • 125
0 votes
0 answers
115 views

How can I get a value from a memory address that changes almost every millisecond?

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond. ScreenShot: I did a hardware ...
user avatar
  • 125
1 vote
1 answer
92 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
user avatar
  • 273
0 votes
1 answer
1k views

In x64dbg, how to set software breakpoint on specific memory address?

This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg. In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
user avatar
-1 votes
2 answers
237 views

How does cheat engine's "dissect data structures" work?

In Cheat Engine there is function for analyse memory. The result of this analysis is types of memory bytes. I can't understand the algorithm of this analysis. How can it define that these bytes are ...
user avatar
0 votes
1 answer
56 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
user avatar
1 vote
0 answers
28 views

API-Monitor not logging buffer

I have a problem with API-Monitor. When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
user avatar
  • 21
0 votes
1 answer
62 views

error shmat function when simulating MIPS file in Qemu

I want to run (simulating) MIPS file with Qemu: $file httpd httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ...
user avatar
  • 177
0 votes
1 answer
126 views

What is copy_block struct in Tricore Arch?

Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below: ld32.w d4, [a0]-0x68D4 I know a0 = 0xD00032E0 but ...
user avatar
0 votes
1 answer
32 views

How can a debugger break on dynamic loaded libraries?

I think I have a massive understanding problem with the following issue: Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
user avatar
  • 3
0 votes
1 answer
154 views

How does radare2 create its memory layout?

Firstly Hello, this is my first post on this forum even though im reading alot here. Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here. I did read ...
user avatar
1 vote
2 answers
722 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
user avatar
1 vote
0 answers
43 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
user avatar
-3 votes
1 answer
301 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
user avatar
1 vote
1 answer
150 views

Rust string capacity lower than string lenght

According to RUST documentation, strings are stored this way : This is a statement I can verify while reversing rust binaries. The thing is that when I am reversing rust binaries, I likely encounter ...
user avatar
  • 27
0 votes
0 answers
54 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
user avatar
1 vote
0 answers
32 views

WinDbg pattern search not returning expected result

I'm searching for a string, say the old "This program cannot run". Switching context to e.g. notepad, non invasive, with page translation 1: kd> !process 0 0 notepad.exe PROCESS ...
user avatar
1 vote
0 answers
62 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
user avatar
0 votes
1 answer
47 views

WinHex : There's a data that does not belong to any module

I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data). Now , when i open the process Entire memory with in WinHex , i can ...
user avatar
1 vote
0 answers
180 views

Subaru Eyesight Images and collision avoidance systems

I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
user avatar
0 votes
1 answer
82 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
user avatar
1 vote
1 answer
161 views

What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?

So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
user avatar
  • 202
1 vote
0 answers
59 views

Can i dump dll from pagefile?

Like the title of this question, im trying to dump dll of process but it only return a message Error: Dllbase is paged (pic below) So is the dll on pagefile and can i extract it from pagefile.sys ? ...
user avatar
4 votes
1 answer
177 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
user avatar
-1 votes
1 answer
566 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
user avatar
0 votes
2 answers
335 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
user avatar
1 vote
2 answers
526 views

Byte-patch a JMP

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
user avatar
  • 11
1 vote
1 answer
81 views

Executable code in the same location differs in memory and on disk

I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
user avatar
  • 21
1 vote
0 answers
200 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
user avatar
-1 votes
1 answer
166 views

How do I view the call stack of an executable?

Basically I'm trying to edit memory (replace branch with a nop so the executable can't branch to auth function). I've done successful reverse engineering on gaming consoles, but I don't really know ...
user avatar
  • 1

1
2 3 4 5