Skip to main content

Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
19 votes
2 answers
15k views

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
perror's user avatar
  • 19.1k
15 votes
2 answers
7k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
SDsolar's user avatar
  • 329
14 votes
2 answers
4k views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
L. Heldt's user avatar
  • 173
12 votes
2 answers
12k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
sherlock's user avatar
  • 1,381
10 votes
1 answer
1k views

What does this memory pattern pointing from the thread-local storage mean?

An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0). First question would be, where can I ...
samuirai's user avatar
  • 3,079
9 votes
2 answers
5k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
Dirk's user avatar
  • 443
8 votes
2 answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
Zarathos's user avatar
  • 185
7 votes
2 answers
7k views

\??\C:\ Question Marks in Paths

I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability ...
user4089's user avatar
7 votes
2 answers
4k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...
Benny's user avatar
  • 828
7 votes
2 answers
6k views

How to retrieve assembly from a raw memory dump?

I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory. I'm looking for a tool that will help me identify ...
Runcible's user avatar
  • 181
7 votes
3 answers
11k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
Ditmar Wendt's user avatar
7 votes
1 answer
801 views

Modules that exist in a process address space

Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list) This is just an ...
user3365's user avatar
  • 197
7 votes
1 answer
491 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
PaulS's user avatar
  • 91
6 votes
2 answers
715 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
Thomas Chopitea's user avatar
6 votes
3 answers
6k views

Does code injected into process memory always belong to a page with RWX access?

I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
Benny's user avatar
  • 828
6 votes
2 answers
5k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
Dominik Antal's user avatar
5 votes
2 answers
1k views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
Dominik Antal's user avatar
5 votes
1 answer
352 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
SRobertJames's user avatar
5 votes
2 answers
475 views

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
Dominik Antal's user avatar
5 votes
1 answer
551 views

Differences in memory dumps of executable data

I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection. Mainly I try to ...
Nordwald's user avatar
  • 2,906
5 votes
1 answer
3k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
Michal Sládeček's user avatar
5 votes
0 answers
266 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
dajolelor's user avatar
4 votes
2 answers
3k views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
3asssains's user avatar
  • 111
4 votes
1 answer
327 views

Weird instructions

In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace: RIP register ...
Ta Thanh Dinh's user avatar
4 votes
2 answers
2k views

How does Ollydbg obtain the memory map (alt+m)? [closed]

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online. How would I get a dump of a process's memory like ...
douggard's user avatar
  • 193
4 votes
1 answer
1k views

What's a good method to find the location of objects in a game [closed]

So in a given game there are objects randomly placed around the map. I've managed (through playing with the memory in cheat engine) find that a single value changes when a certain object is within my ...
FraserOfSmeg's user avatar
4 votes
2 answers
1k views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
Mikubyte's user avatar
  • 153
4 votes
2 answers
1k views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
0xAK's user avatar
  • 668
4 votes
2 answers
2k views

router: how to break into boot?

I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. ...
rddead's user avatar
  • 43
4 votes
2 answers
1k views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
Just a learner's user avatar
4 votes
1 answer
321 views

Master of Orion and scanmem

I am looking to use scanmem to change in game credits in the new Master of Orion (2016). Steps I have taken: Install and run scanmem as root Track credits successfully using scanmem It ...
joelcorey's user avatar
4 votes
1 answer
3k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
SelfTaught's user avatar
4 votes
1 answer
3k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
Andrew Savinykh's user avatar
4 votes
1 answer
1k views

Runtime memory reading with injection

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. My desired values of that function are: [ESP + 4] which ...
Dominik Antal's user avatar
4 votes
2 answers
1k views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
InfectedPacket's user avatar
4 votes
1 answer
758 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
OneAndOnly's user avatar
4 votes
1 answer
2k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
Paradoxis's user avatar
  • 173
4 votes
1 answer
317 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
Coldblackice's user avatar
4 votes
1 answer
3k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
Joona's user avatar
  • 51
4 votes
0 answers
170 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
ylluminate's user avatar
4 votes
0 answers
207 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
ChipsAhoy's user avatar
4 votes
0 answers
329 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
user3365's user avatar
  • 197
3 votes
3 answers
1k views

Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?

So by reading this rop paper from Dr. Shacham, I know that it is not very hard to find gadgets set that has Turning-complete computation ability. So I am thinking that, in theoretical, are all the ...
lllllllllllll's user avatar
3 votes
1 answer
627 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
user avatar
3 votes
2 answers
10k views

How to set a breakpoint on a 64 bit process button with x64dbg?

I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
PhotoScript's user avatar
3 votes
2 answers
1k views

How to identify code ran when clicking on an object in a game

I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
FraserOfSmeg's user avatar
3 votes
2 answers
891 views

0x09-0x0d not taken into account with scanf

I've encountered something I can't explain. Here is the problem #include <stdio.h> #include <string.h> #include <stdlib.h> void ask() { char name[64]; printf("What is your ...
Hackndo's user avatar
  • 475
3 votes
1 answer
480 views

Do all games have static base addresses for values like gold and energy?

I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
3asssains's user avatar
  • 111
3 votes
4 answers
11k views

Determine NAND Flash chip type and dump contents

I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND ...
hft's user avatar
  • 191
3 votes
1 answer
234 views

Load process from memory dump

Are there any tools that can "record" the memory space of a process and then be able to restore it from a certain timestamp? As in, the process is recreated in the exact same state as if &...
Sebi's user avatar
  • 153

1
2 3 4 5