Skip to main content

Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
0 votes
1 answer
95 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
3 votes
1 answer
239 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
3 votes
2 answers
10k views

How to set a breakpoint on a 64 bit process button with x64dbg?

I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
1 vote
0 answers
57 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
2 votes
1 answer
840 views

What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?

I have a 64bit exe I'm debugging with x64dbg. I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing). ...
2 votes
1 answer
301 views

Has there been any success in using deep learning for reverse engineering?

So has there been any success in using deep learning for doing reverse engineering? i couldn't find anything useful other than some theoretical papers, so was there any talk about this in recent ...
2 votes
1 answer
1k views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
1 vote
1 answer
794 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
1 vote
0 answers
104 views

Can I see Stack and Heap value/addresses from this simple C# program process?

I am studying reading dumped memory image and analyzing it with volatility. I wrote this c# program and I was hoping to see the analyzed data from Volatiliy namespace CSharpEx1 { class Program ...
2 votes
2 answers
358 views

Issues writing a bootloader in x86 16-bit machine code

I am having trouble displaying simple text. I am trying to do it all in machine code with INT 10h, but: I can't find the binary opcode for INT 10h anywhere in the Intel Manual. I can't figure out how ...
2 votes
0 answers
380 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
2 votes
0 answers
76 views

Why is vdso remapped after setting stack space to unlimited?

On my Ubuntu 16.04, 64 bit the default stack size is 8192 bytes. If I set it to unlimited, seems like the vdso is remapped to a completely different memory region. $ ulimit -s 8192 $ cat /proc/`...
2 votes
1 answer
799 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
0 votes
2 answers
229 views

Techniques for marking memory changes

i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory ...
2 votes
2 answers
2k views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
15 votes
2 answers
7k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
1 vote
1 answer
2k views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
0 votes
1 answer
97 views

How do the new Swedish implantable microchips work?

So now we see that the Swedes are going large with their implantable chips which allow them to carry out certain kinds of transactions without using plastic. Thousands of people in Sweden get ...
1 vote
1 answer
266 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
0 votes
1 answer
419 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
1 vote
1 answer
10k views

Reverse engineering a golang binary file

I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
3 votes
0 answers
1k views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
1 vote
0 answers
137 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
0 votes
1 answer
246 views

Reversing C# exe,Questions.Help

I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second. I want to rewrite its dataseries before the new data comes with my own dataset. ...
7 votes
2 answers
7k views

\??\C:\ Question Marks in Paths

I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability ...
0 votes
1 answer
118 views

Is it possible to (core-dump) recover a video in memory of the player (VLC) started without a debugger?

Essentially, I'm wondering how difficult or possible it would be to do a core-dump on an already running process that was started without a debugger. I have a video that I opened in VLC (and is still ...
2 votes
1 answer
2k views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
3 votes
0 answers
167 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
3 votes
4 answers
11k views

Determine NAND Flash chip type and dump contents

I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND ...
4 votes
2 answers
3k views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
14 votes
2 answers
4k views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
1 vote
1 answer
338 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
1 vote
2 answers
876 views

How to monitor specific variables in a running process?

I would like to monitor, record, specific variables in an application but I am not sure what is the right way to approach this problem. The application is a mix of C(5%) and C++(95%) and it is ...
7 votes
1 answer
491 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
3 votes
1 answer
4k views

Find what writes to a dynamic memory address

I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
1 vote
0 answers
1k views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
19 votes
2 answers
15k views

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
2 votes
1 answer
1k views

How to find out which instruction wrote to a specific address?

I'm not an expert in reversing and even though Googling is usually enough, this time I can't find a solution. I have this program that calculates a value from some data it received from a server. I ...
4 votes
0 answers
170 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
1 vote
3 answers
4k views

Reading Physical Memory

I am trying to determine how to read physical memory. I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a ...
0 votes
1 answer
1k views

how do I define an address with a module and an offset in c++

I'm trying to define an address so that I can edit its memory later, however I can't figure out a way to access it. The base address is "program.exe"+00D23440 and has an offset of +30 Normally you ...
1 vote
2 answers
2k views

Dumping SQLITE database out of memory and viewing without original DB

I am researching some malware which loads multiple Sqlite Databases into memory during its operation. I've managed to dump the memory to disk in a large block however I cannot view the databases ...
4 votes
1 answer
2k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
2 votes
3 answers
3k views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
2 votes
0 answers
1k views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
1 vote
1 answer
3k views

How does new operator internally work in C++?

The articles explaining the internals of malloc and free in glibc are abundant in number. However, I'd like to know how dynamic memory management works in C++, specifically the nitty gritty of new and ...
3 votes
2 answers
7k views

Tools for Windows 10 hiberfil.sys file analysis

As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened. Is there any tools (free, paid, open source, any) that ...
4 votes
2 answers
1k views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
3 votes
1 answer
2k views

PE file format: How can I find the heap memory space in a running WinNT program?

I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
0 votes
1 answer
1k views

Viewing Physical Memory Addresses in OllyDbg or any program?

I'm having a tough time finding any information at all concerning physical memory addresses and if/how I can get them from a program at runtime (Windows NT/10). When I run a program in OllyDbg and I'm ...