Questions tagged [memory]
Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.
231
questions
0
votes
0
answers
25
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
0
votes
0
answers
40
views
How to exclude "Process Monitor" from Themida's list of monitoring programs
Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags?
I want to exclude Sysinternals "Process Monitor&...
- 169
1
vote
0
answers
70
views
UBIFS image weirdness [SOLVED]
So, I dumped old routers ubifs image from memory and apparently it can't be read or mounted, throwing errors like "missing block size" and "missing data" although I see in hexdump ...
3
votes
1
answer
146
views
Load process from memory dump
Are there any tools that can "record" the memory space of a process and then be able to restore it from a certain timestamp? As in, the process is recreated in the exact same state as if &...
- 153
2
votes
0
answers
40
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
3
votes
1
answer
94
views
A few questions about reloc tables and base memory
A friend and I are poking around with some 32-bit Windows binaries and wanted to get some info about relocation tables.
What is the difference between an exe that does not contain a relocation table (...
- 157
3
votes
4
answers
468
views
Reverse Engineering CTF help
I am having trouble figuring out this microcorruption challenge in the link below: https://microcorruption.com/debugger/Halifax
Basically, the 0x7f interrupt has been disabled so I must reenable it ...
- 141
2
votes
0
answers
125
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 21
3
votes
1
answer
158
views
GDB breakpoint crashes at a correct memory location
I'm trying to debug binaries of a a firmware running Linux with no ASLR, binaries are not compiled with PIE either so I have no issue getting the memory locations.
So after including gdbserver in the ...
3
votes
0
answers
383
views
Anti Dumping Techniques (C++)
how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle?
I tried this already but it didnt work. Scylla could still dump it fine.
- 31
3
votes
0
answers
44
views
Data placement in memory
I am playing with buffer overflow attacks in C. I have the following code:
int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory
int main(int argc, char**...
- 31
1
vote
0
answers
35
views
How to prevent dynamic loader from modifying binary in memory?
I have patched a loadable object (an .so file) from this:
xor eax,0x304b7c0
to this:
mov eax,0x0
When I try to run my binary with these modifications, the application loads the .so file and then it ...
- 11
0
votes
1
answer
1k
views
ghidra returning wrong function address
I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function
I am using this hook
const ghidraImageBase = 0x00100000;
const ...
- 71
1
vote
0
answers
40
views
Is it possible for different dynamic memory addresses to share the same offset value?
I am currently using cheat engine to hack a game. I used the pointer scanner to find some pointers to the pistol ammo memory location. I then went to look for pointers to the shotgun ammo memory ...
- 131
1
vote
1
answer
113
views
Help starting with UEFI/SMM exploits
I have a 845 g7 with a bios 1.06, which has a load of CVEs which allow SMM and DXE exploits:
https://support.hp.com/ca-en/drivers/selfservice/hp-elitebook-845-g7-notebook-pc/37506818 (under the UEFI ...
- 13
2
votes
2
answers
320
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
- 1,769
1
vote
0
answers
182
views
How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?
I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
- 111
1
vote
1
answer
731
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
1
vote
1
answer
531
views
How to extract specific data from memory
I'm totally new to this reverse engineering stuff.
I'm working on my own project and trying to parse poker games from PokerStars application. I have already done with injecting my DLL to the app, but ...
0
votes
1
answer
221
views
Extract certificate information of a process from memory dump
I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried ...
1
vote
0
answers
174
views
ReadProcessMemory from host to Hyper-V Windows Guest VM
Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V?
The host is running Windows 11 the Guest is running ...
- 11
1
vote
0
answers
52
views
Scraping data from an audio analyzer application
Briefly:
I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start?
...
1
vote
1
answer
1k
views
How does Cheat Engine offset calculation work?
I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number.
IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C;
/...
- 153
2
votes
0
answers
462
views
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.
I debug an Android application with Frida, how can I put this address in Frida to watch this value?
I ...
- 41
1
vote
1
answer
2k
views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
5
votes
1
answer
303
views
How to reverse engineer a setjmp/longjmp sequence?
I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env.
There's a great writeup of the musl setjmp but I can find ...
- 187
3
votes
1
answer
334
views
How is lite hash rate (LHR) of Nvidia implemented?
Nvidia limited some of their GPUs with LHR to decrease the performance of Ethereum mining. What in detail is LHR doing? It seems to limit non sequential memory operations (which is actually not what ...
- 131
0
votes
2
answers
89
views
Not Understanding the FU540 Boot Process
I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on.
I'm using MSEL = 1111 based on the recommendation ...
1
vote
1
answer
527
views
Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida
I am trying to understand the usage of calls to CC_MD5 in an iOS application.
From Apple's man page I can see that when it is called it requires 3 arguments:
extern unsigned char *
CC_MD5(const void *...
- 167
0
votes
1
answer
533
views
How can I get the correct offset from that instruction?
I have the following instructions:
The registers' values in the First instruction are:
RAX=0000000033307EE0
RCX=0000000000000000
The registers' values in the Second instruction are:
RAX=...
- 269
2
votes
1
answer
208
views
How to jump to a new empty memory that related to the program to write another code there?
I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
- 269
0
votes
0
answers
303
views
How can I get a value from a memory address that changes almost every millisecond?
After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond.
ScreenShot:
I did a hardware ...
- 269
1
vote
1
answer
234
views
macOS under M1, cannot find library
I'm looking for the following dylib file which is included from process loginwindow.
If I run vmmap to inspect loginwindow while it's up and running I get :
user@mycomp / % sudo vmmap -I ``pgrep ...
- 293
0
votes
1
answer
4k
views
In x64dbg, how to set software breakpoint on specific memory address?
This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg.
In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
- 137
-1
votes
2
answers
793
views
How does cheat engine's "dissect data structures" work?
In Cheat Engine there is function for analyse memory. The result of this analysis is types of memory bytes. I can't understand the algorithm of this analysis. How can it define that these bytes are ...
0
votes
1
answer
69
views
Expanding .data section at particular area
I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
- 61
1
vote
0
answers
46
views
API-Monitor not logging buffer
I have a problem with API-Monitor.
When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
- 31
0
votes
1
answer
146
views
error shmat function when simulating MIPS file in Qemu
I want to run (simulating) MIPS file with Qemu:
$file httpd
httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header
...
- 177
0
votes
1
answer
181
views
What is copy_block struct in Tricore Arch?
Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below:
ld32.w d4, [a0]-0x68D4
I know a0 = 0xD00032E0 but ...
- 147
0
votes
1
answer
115
views
How can a debugger break on dynamic loaded libraries?
I think I have a massive understanding problem with the following issue:
Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
- 35
0
votes
1
answer
218
views
How does radare2 create its memory layout?
Firstly Hello,
this is my first post on this forum even though im reading alot here.
Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here.
I did read ...
- 3
3
votes
2
answers
1k
views
find cheat engine pointers in ghidra
I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
Note,
as comments point out: health - I talk ...
- 31
1
vote
0
answers
44
views
Strange memory allocation behaviour
I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of.
The expression in question is this:
unsigned ...
- 23
-2
votes
1
answer
494
views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
- 147
1
vote
1
answer
268
views
Rust string capacity lower than string lenght
According to RUST documentation, strings are stored this way :
This is a statement I can verify while reversing rust binaries.
The thing is that when I am reversing rust binaries, I likely encounter ...
- 72
0
votes
0
answers
133
views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
1
vote
0
answers
39
views
WinDbg pattern search not returning expected result
I'm searching for a string, say the old "This program cannot run".
Switching context to e.g. notepad, non invasive, with page translation
1: kd> !process 0 0 notepad.exe
PROCESS ...
- 111
1
vote
0
answers
89
views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
- 31
0
votes
1
answer
56
views
WinHex : There's a data that does not belong to any module
I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data).
Now , when i open the process Entire memory with in WinHex , i can ...
1
vote
0
answers
350
views
Subaru Eyesight Images and collision avoidance systems
I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
- 11