Skip to main content

Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

58 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
264 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
dajolelor's user avatar
4 votes
0 answers
168 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
ylluminate's user avatar
4 votes
0 answers
207 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
ChipsAhoy's user avatar
4 votes
0 answers
329 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
user3365's user avatar
  • 197
3 votes
0 answers
490 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
3 votes
0 answers
45 views

Data placement in memory

I am playing with buffer overflow attacks in C. I have the following code: int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory int main(int argc, char**...
Stone Paul's user avatar
3 votes
0 answers
303 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
nitro2k01's user avatar
  • 131
3 votes
0 answers
1k views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
Jurriaan Bremer's user avatar
3 votes
0 answers
167 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
kvmN00bsky's user avatar
2 votes
0 answers
55 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
2 votes
0 answers
195 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
soqq's user avatar
  • 21
2 votes
0 answers
527 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
frida's user avatar
  • 41
2 votes
0 answers
380 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
user3397540's user avatar
2 votes
0 answers
76 views

Why is vdso remapped after setting stack space to unlimited?

On my Ubuntu 16.04, 64 bit the default stack size is 8192 bytes. If I set it to unlimited, seems like the vdso is remapped to a completely different memory region. $ ulimit -s 8192 $ cat /proc/`...
sherlock's user avatar
  • 1,381
2 votes
0 answers
1k views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
Zer0Mem0ry's user avatar
2 votes
0 answers
644 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
forbiddenhi's user avatar
2 votes
0 answers
501 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
forbiddenhi's user avatar
2 votes
0 answers
1k views

Map virtual addresses to physical addresses

I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
user3002428's user avatar
2 votes
0 answers
712 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
Lexx Luxx's user avatar
  • 203
1 vote
0 answers
46 views

Unknown string encoding

I'm new to reverse, my question may be stupid. I am trying to reverse a function in the application that reads a string at the address and concatenate it to another char[250] v30; char[20] v31; ... ...
SHVED's user avatar
  • 11
1 vote
0 answers
126 views

UBIFS image weirdness [SOLVED]

So, I dumped old routers ubifs image from memory and apparently it can't be read or mounted, throwing errors like "missing block size" and "missing data" although I see in hexdump ...
Josip Stjepanović's user avatar
1 vote
0 answers
37 views

How to prevent dynamic loader from modifying binary in memory?

I have patched a loadable object (an .so file) from this: xor eax,0x304b7c0 to this: mov eax,0x0 When I try to run my binary with these modifications, the application loads the .so file and then it ...
user34087's user avatar
1 vote
0 answers
40 views

Is it possible for different dynamic memory addresses to share the same offset value?

I am currently using cheat engine to hack a game. I used the pointer scanner to find some pointers to the pistol ammo memory location. I then went to look for pointers to the shotgun ammo memory ...
Jason Crosby's user avatar
1 vote
0 answers
224 views

How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?

I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
ChickenOverlord's user avatar
1 vote
0 answers
228 views

ReadProcessMemory from host to Hyper-V Windows Guest VM

Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V? The host is running Windows 11 the Guest is running ...
x3p0's user avatar
  • 11
1 vote
0 answers
55 views

Scraping data from an audio analyzer application

Briefly: I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start? ...
gabrielsalvador's user avatar
1 vote
0 answers
46 views

API-Monitor not logging buffer

I have a problem with API-Monitor. When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
Trac3r's user avatar
  • 31
1 vote
0 answers
45 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
squ1dd13's user avatar
1 vote
0 answers
46 views

WinDbg pattern search not returning expected result

I'm searching for a string, say the old "This program cannot run". Switching context to e.g. notepad, non invasive, with page translation 1: kd> !process 0 0 notepad.exe PROCESS ...
Assaf Levy's user avatar
1 vote
0 answers
95 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
wcerfgba's user avatar
1 vote
0 answers
400 views

Subaru Eyesight Images and collision avoidance systems

I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
popqwert 27's user avatar
1 vote
0 answers
88 views

Can i dump dll from pagefile?

Like the title of this question, im trying to dump dll of process but it only return a message Error: Dllbase is paged (pic below) So is the dll on pagefile and can i extract it from pagefile.sys ? ...
Brian MJ's user avatar
1 vote
0 answers
310 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
Davide Maggioni's user avatar
1 vote
0 answers
141 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
Alexandre Vieira's user avatar
1 vote
0 answers
250 views

IDA map one memory address to another

I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
bojitazaxu's user avatar
1 vote
0 answers
57 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
dsasmblr's user avatar
  • 2,234
1 vote
0 answers
104 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
RollRoll's user avatar
  • 111
1 vote
0 answers
137 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
CTS_AE's user avatar
  • 111
1 vote
0 answers
121 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
Paolo Cazzaniga's user avatar
1 vote
0 answers
1k views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
poolshark021's user avatar
1 vote
0 answers
948 views

OllyDbg: break on memory allocation?

In OllyDbg, is there a way to break when memory is allocated? Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/...
Geoff's user avatar
  • 11
1 vote
0 answers
1k views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
Zergatul's user avatar
  • 111
1 vote
0 answers
282 views

Checksum reverse engineering help

I'm a newbie here, and I don't have a lot of experience with reverse engineering, so I'm asking for your help. I have dumped a Mifare Classic card several times, because I wanted to try understand ...
Abe Johnson's user avatar
1 vote
0 answers
143 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
Paze's user avatar
  • 11
1 vote
0 answers
238 views

Scanning memory accessed by a DLL

I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to ...
Joona's user avatar
  • 51
0 votes
0 answers
36 views

Change Mac address

I have read the NAND memory MT29F2G08ABAEAWP contents via the RT809F programmer from IP Camera, when I have written the program (.bin) to the new NAND memory the Mac address and serial number of ...
Motaz's user avatar
  • 1
0 votes
0 answers
26 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
Unknown X's user avatar
0 votes
1 answer
35 views

Buspirate_spi and flashrom opensource software

I have a question about buspirate_spi programmer and flashrom. I have a new Flash rom Boye BY25Q128AS similar to the winbond W25Q128.V in the flashrom list. How can I dump the data from this specific ...
Renin Roy's user avatar
0 votes
0 answers
101 views

Searching for a byte pattern and then hooking all instances of it using frida on iOS

I'm using a frida script to scan for a certain byte pattern when I launch an iOS app. I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
Jon's user avatar
  • 177
0 votes
0 answers
505 views

Failed to attach: unable to connect to remote frida-server: closed

I'm trying to bypass Frida (Android) local port scanning detection, so I followed this guide. The sequence of commands I used are : (magic_man is alias for frida_server) adb root adb push magic_man /...
exploitr's user avatar
  • 101