Skip to main content

Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
15 votes
2 answers

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
SDsolar's user avatar
  • 329
19 votes
2 answers

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
perror's user avatar
  • 19.1k
9 votes
2 answers

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
Dirk's user avatar
  • 443
8 votes
2 answers

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
Zarathos's user avatar
  • 185
7 votes
3 answers

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
Ditmar Wendt's user avatar
6 votes
3 answers

Does code injected into process memory always belong to a page with RWX access?

I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
Benny's user avatar
  • 828
5 votes
2 answers

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
Dominik Antal's user avatar
4 votes
2 answers

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
Mikubyte's user avatar
  • 153
4 votes
2 answers

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
InfectedPacket's user avatar
2 votes
1 answer

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
John P's user avatar
  • 207
2 votes
1 answer

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from This BIN file contains the low level board initialization,...
jc__'s user avatar
  • 123
0 votes
1 answer

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
Coldblackice's user avatar
-2 votes
1 answer

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
Unicornux's user avatar
  • 147