Questions tagged [memory]
Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.
239
questions
0
votes
1
answer
43
views
Buspirate_spi and flashrom opensource software
I have a question about buspirate_spi programmer and flashrom. I have a new Flash rom Boye BY25Q128AS similar to the winbond W25Q128.V in the flashrom list. How can I dump the data from this specific ...
CommunityBot
- 1
0
votes
1
answer
1k
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
CommunityBot
- 1
0
votes
1
answer
285
views
Hooking flash player dll
Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP.
Do ...
CommunityBot
- 1
1
vote
0
answers
44
views
How to configure Ghidra Memory Map use Script API?
How to configure "Memory Map" for RAM image use Ghidra Script API? For example, here is Memory layout created by python script:
.text start: 0x80004000
.text end: 0x8079e4d0
.text length: ...
- 235
0
votes
0
answers
42
views
Why mov empty block to register?
Why MOV a bunch of 00s to register?
I have seen these empty blocks a lot of times being referenced this way.
- 1
2
votes
2
answers
181
views
error shmat function when simulating MIPS file in Qemu
I want to run (simulating) MIPS file with Qemu:
$file httpd
httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header
...
- 111
0
votes
0
answers
36
views
Change Mac address
I have read the NAND memory MT29F2G08ABAEAWP contents via the RT809F programmer from IP Camera,
when I have written the program (.bin) to the new NAND memory the Mac address and serial number of ...
- 1
1
vote
0
answers
48
views
Unknown string encoding
I'm new to reverse, my question may be stupid.
I am trying to reverse a function in the application that reads a string at the address and concatenate it to another
char[250] v30;
char[20] v31;
...
...
- 11
0
votes
0
answers
30
views
How to trigger calls and attach to functions on a running process?
I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
- 11
0
votes
0
answers
107
views
Searching for a byte pattern and then hooking all instances of it using frida on iOS
I'm using a frida script to scan for a certain byte pattern when I launch an iOS app.
I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
- 177
3
votes
4
answers
571
views
Reverse Engineering CTF help
I am having trouble figuring out this microcorruption challenge in the link below: https://microcorruption.com/debugger/Halifax
Basically, the 0x7f interrupt has been disabled so I must reenable it ...
- 1
0
votes
0
answers
578
views
Failed to attach: unable to connect to remote frida-server: closed
I'm trying to bypass Frida (Android) local port scanning detection, so I followed this guide. The sequence of commands I used are : (magic_man is alias for frida_server)
adb root
adb push magic_man /...
- 101
0
votes
0
answers
76
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
1
vote
0
answers
409
views
Subaru Eyesight Images and collision avoidance systems
I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
- 1
0
votes
0
answers
105
views
How to exclude "Process Monitor" from Themida's list of monitoring programs
Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags?
I want to exclude Sysinternals "Process Monitor&...
- 169
1
vote
0
answers
131
views
UBIFS image weirdness [SOLVED]
So, I dumped old routers ubifs image from memory and apparently it can't be read or mounted, throwing errors like "missing block size" and "missing data" although I see in hexdump ...
3
votes
1
answer
237
views
Load process from memory dump
Are there any tools that can "record" the memory space of a process and then be able to restore it from a certain timestamp? As in, the process is recreated in the exact same state as if &...
- 10.9k
5
votes
1
answer
3k
views
GDB find string strange results
I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
CommunityBot
- 1
2
votes
0
answers
58
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
3
votes
1
answer
485
views
Do all games have static base addresses for values like gold and energy?
I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
- 297
3
votes
1
answer
142
views
A few questions about reloc tables and base memory
A friend and I are poking around with some 32-bit Windows binaries and wanted to get some info about relocation tables.
What is the difference between an exe that does not contain a relocation table (...
- 16.5k
1
vote
2
answers
585
views
Reverse Engineering Javascript - Out of Memory
I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
CommunityBot
- 1
3
votes
2
answers
2k
views
find cheat engine pointers in ghidra
I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
Note,
as comments point out: health - I talk ...
- 115
-1
votes
2
answers
944
views
How does cheat engine's "dissect data structures" work?
In Cheat Engine there is function for analyse memory. The result of this analysis is types of memory bytes. I can't understand the algorithm of this analysis. How can it define that these bytes are ...
CommunityBot
- 1
3
votes
1
answer
208
views
GDB breakpoint crashes at a correct memory location
I'm trying to debug binaries of a a firmware running Linux with no ASLR, binaries are not compiled with PIE either so I have no issue getting the memory locations.
So after including gdbserver in the ...
2
votes
0
answers
205
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 21
2
votes
2
answers
351
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
CommunityBot
- 1
3
votes
0
answers
511
views
Anti Dumping Techniques (C++)
how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle?
I tried this already but it didnt work. Scylla could still dump it fine.
- 31
2
votes
1
answer
221
views
How to jump to a new empty memory that related to the program to write another code there?
I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
CommunityBot
- 1
3
votes
0
answers
46
views
Data placement in memory
I am playing with buffer overflow attacks in C. I have the following code:
int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory
int main(int argc, char**...
- 31
2
votes
1
answer
2k
views
ghidra returning wrong function address
I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function
I am using this hook
const ghidraImageBase = 0x00100000;
const ...
- 191
1
vote
0
answers
37
views
How to prevent dynamic loader from modifying binary in memory?
I have patched a loadable object (an .so file) from this:
xor eax,0x304b7c0
to this:
mov eax,0x0
When I try to run my binary with these modifications, the application loads the .so file and then it ...
- 11
1
vote
0
answers
40
views
Is it possible for different dynamic memory addresses to share the same offset value?
I am currently using cheat engine to hack a game. I used the pointer scanner to find some pointers to the pistol ammo memory location. I then went to look for pointers to the shotgun ammo memory ...
- 131
1
vote
1
answer
127
views
Help starting with UEFI/SMM exploits
I have a 845 g7 with a bios 1.06, which has a load of CVEs which allow SMM and DXE exploits:
https://support.hp.com/ca-en/drivers/selfservice/hp-elitebook-845-g7-notebook-pc/37506818 (under the UEFI ...
- 796
2
votes
1
answer
3k
views
Does x64dbg display the whole memory info even for a simple program opened?
I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below.
#include <stdio.h>
void main()
{
int x, y, z;
while(...
- 461
4
votes
2
answers
1k
views
How can I find my variables in the running process?
I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program.
#include <iostream>
#include <string>
using ...
- 461
1
vote
0
answers
229
views
How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?
I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
- 111
1
vote
1
answer
1k
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
- 36.9k
0
votes
1
answer
268
views
Extract certificate information of a process from memory dump
I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried ...
- 861
1
vote
1
answer
696
views
How to extract specific data from memory
I'm totally new to this reverse engineering stuff.
I'm working on my own project and trying to parse poker games from PokerStars application. I have already done with injecting my DLL to the app, but ...
- 146
1
vote
0
answers
235
views
ReadProcessMemory from host to Hyper-V Windows Guest VM
Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V?
The host is running Windows 11 the Guest is running ...
- 11
1
vote
0
answers
55
views
Scraping data from an audio analyzer application
Briefly:
I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start?
...
- 1,130
1
vote
1
answer
1k
views
How does Cheat Engine offset calculation work?
I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number.
IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C;
/...
- 16.5k
2
votes
0
answers
534
views
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.
I debug an Android application with Frida, how can I put this address in Frida to watch this value?
I ...
- 11.8k
1
vote
1
answer
3k
views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
- 11.8k
5
votes
1
answer
357
views
How to reverse engineer a setjmp/longjmp sequence?
I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env.
There's a great writeup of the musl setjmp but I can find ...
- 11.8k
3
votes
1
answer
359
views
How is lite hash rate (LHR) of Nvidia implemented?
Nvidia limited some of their GPUs with LHR to decrease the performance of Ethereum mining. What in detail is LHR doing? It seems to limit non sequential memory operations (which is actually not what ...
- 11.8k
0
votes
2
answers
101
views
Not Understanding the FU540 Boot Process
I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on.
I'm using MSEL = 1111 based on the recommendation ...
1
vote
1
answer
607
views
Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida
I am trying to understand the usage of calls to CC_MD5 in an iOS application.
From Apple's man page I can see that when it is called it requires 3 arguments:
extern unsigned char *
CC_MD5(const void *...
- 1,145
0
votes
1
answer
660
views
How can I get the correct offset from that instruction?
I have the following instructions:
The registers' values in the First instruction are:
RAX=0000000033307EE0
RCX=0000000000000000
The registers' values in the Second instruction are:
RAX=...
- 16.5k