Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

15
votes
2answers
9k views

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
14
votes
2answers
3k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
9
votes
2answers
3k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
9
votes
1answer
831 views

What does this memory pattern pointing from the thread-local storage mean?

An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0). First question would be, where can I ...
8
votes
2answers
1k views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
7
votes
1answer
304 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
6
votes
2answers
4k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
6
votes
2answers
2k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...
6
votes
2answers
591 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
6
votes
3answers
7k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
6
votes
2answers
4k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
5
votes
2answers
3k views

\??\C:\ Question Marks in Paths

I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability ...
5
votes
3answers
4k views

Does code injected into process memory always belong to a page with RWX access?

I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
5
votes
2answers
3k views

How to retrieve assembly from a raw memory dump?

I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory. I'm looking for a tool that will help me identify ...
5
votes
1answer
512 views

Modules that exist in a process address space

Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list) This is just an ...
5
votes
1answer
795 views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
5
votes
1answer
395 views

Differences in memory dumps of executable data

I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection. Mainly I try to ...
4
votes
2answers
891 views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
4
votes
2answers
600 views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
4
votes
2answers
2k views

How does Ollydbg obtain the memory map (alt+m)? [closed]

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online. How would I get a dump of a process's memory like ...
4
votes
1answer
719 views

What's a good method to find the location of objects in a game [closed]

So in a given game there are objects randomly placed around the map. I've managed (through playing with the memory in cheat engine) find that a single value changes when a certain object is within my ...
4
votes
2answers
656 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
4
votes
2answers
562 views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
4
votes
1answer
2k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
4
votes
2answers
412 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
4
votes
0answers
94 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
4
votes
0answers
166 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
3
votes
3answers
808 views

Are all the code sequences ended with “ret” potential “gadgets” for ROP attack?

So by reading this rop paper from Dr. Shacham, I know that it is not very hard to find gadgets set that has Turning-complete computation ability. So I am thinking that, in theoretical, are all the ...
3
votes
1answer
421 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
3
votes
1answer
288 views

Weird instructions

In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace: RIP register ...
3
votes
2answers
313 views

How to identify code ran when clicking on an object in a game

I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
3
votes
2answers
105 views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
3
votes
2answers
278 views

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
3
votes
1answer
216 views

Master of Orion and scanmem

I am looking to use scanmem to change in game credits in the new Master of Orion (2016). Steps I have taken: Install and run scanmem as root Track credits successfully using scanmem It ...
3
votes
1answer
104 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
3
votes
1answer
1k views

Using Python pydbg - Find out what addresses does an instruction access

I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do? The ...
3
votes
1answer
408 views

How to find address of more complicated, unknown data structures

I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory ...
3
votes
2answers
2k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
3
votes
1answer
723 views

Obtaining MmNonPagedPoolStart on x64 systems

On a x64 Windows 7 I want to get the limits of non paged pool. I know that _KDDEBUGGER_DATA64 structure has this information (fields like MmNonPagedPoolStart and MmNonPagedPoolEnd). On x86 systems ...
3
votes
1answer
3k views

How to edit an executable's “.data” segment?

This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information. Anyway, I have two static classes ...
3
votes
0answers
85 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
3
votes
0answers
604 views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
3
votes
0answers
278 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
2
votes
3answers
869 views

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function ...
2
votes
2answers
362 views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
2
votes
2answers
343 views

0x09-0x0d not taken into account with scanf

I've encountered something I can't explain. Here is the problem #include <stdio.h> #include <string.h> #include <stdlib.h> void ask() { char name[64]; printf("What is your ...
2
votes
1answer
3k views

Process Dumping and Ida

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG. I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
2
votes
1answer
1k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
2
votes
2answers
521 views

Redirecting/Remapping/Rerouting a Memory Access

I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub: .text:008EC420 ; ...