Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

48 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
116 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
4
votes
1answer
2k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
4
votes
0answers
195 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
3
votes
0answers
142 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
3
votes
0answers
315 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
2
votes
0answers
131 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
2
votes
0answers
62 views

Why is vdso remapped after setting stack space to unlimited?

On my Ubuntu 16.04, 64 bit the default stack size is 8192 bytes. If I set it to unlimited, seems like the vdso is remapped to a completely different memory region. $ ulimit -s 8192 $ cat /proc/`...
2
votes
0answers
770 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
2
votes
0answers
1k views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
2
votes
0answers
581 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
2
votes
0answers
393 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
2
votes
0answers
1k views

Map virtual addresses to physical addresses

I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
2
votes
0answers
688 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
1answer
107 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
1
vote
0answers
18 views

API-Monitor not logging buffer

I have a problem with API-Monitor. When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
1
vote
2answers
435 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
0answers
36 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
1
vote
0answers
28 views

WinDbg pattern search not returning expected result

I'm searching for a string, say the old "This program cannot run". Switching context to e.g. notepad, non invasive, with page translation 1: kd> !process 0 0 notepad.exe PROCESS ...
1
vote
0answers
60 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
1
vote
0answers
111 views

Subaru Eyesight Images and collision avoidance systems

I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
1
vote
0answers
49 views

Can i dump dll from pagefile?

Like the title of this question, im trying to dump dll of process but it only return a message Error: Dllbase is paged (pic below) So is the dll on pagefile and can i extract it from pagefile.sys ? ...
1
vote
0answers
142 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
1
vote
0answers
119 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
1
vote
0answers
163 views

IDA map one memory address to another

I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
1
vote
0answers
50 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
1
vote
0answers
65 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
1
vote
0answers
320 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
1
vote
0answers
120 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
1
vote
0answers
103 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
1
vote
0answers
883 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
1
vote
0answers
770 views

OllyDbg: break on memory allocation?

In OllyDbg, is there a way to break when memory is allocated? Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/...
1
vote
0answers
799 views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
1
vote
0answers
245 views

Checksum reverse engineering help

I'm a newbie here, and I don't have a lot of experience with reverse engineering, so I'm asking for your help. I have dumped a Mifare Classic card several times, because I wanted to try understand ...
1
vote
0answers
134 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
1
vote
0answers
203 views

Scanning memory accessed by a DLL

I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to ...
0
votes
0answers
96 views

How can I get a value from a memory address that changes almost every millisecond?

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond. ScreenShot: I did a hardware ...
0
votes
0answers
36 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
0answers
57 views

IDA help me understand these operations on the memory

I have a stripped binary, which I want to reverse engineer. I spent quite some time with it, and dug myself through most of it, however, I got stuck near these lines. Context: the program has 5 local ...
0
votes
0answers
110 views

Replacing a memory block in Ghidra

I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't ...
0
votes
0answers
39 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
0answers
48 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
0answers
51 views

How to get pointer's address?

I've tried to reverse engineering Clash Royale. First strange thing is that I can't find libg.so in maps. cat /proc/<pid>/maps | grep libg.so As I understand split_config.arm64_v8a.apk contains ...
0
votes
2answers
238 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
0
votes
0answers
47 views

Means of generating file hashes

I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I'...
0
votes
0answers
587 views

Getting “Access violation executing location” error

I am trying to execute this assembly function. But after calling Test_init function, I am getting "Access violation executing location" error at line "add esp,4". sub_402110 proc near ; ...
-1
votes
1answer
384 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
-1
votes
1answer
222 views

Hooking flash player dll

Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. Do ...
-1
votes
2answers
103 views

How does cheat engine's “dissect data structures” work?

In Cheat Engine there is function for analyse memory. The result of this analysis is types of memory bytes. I can't understand the algorithm of this analysis. How can it define that these bytes are ...