Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
1
vote
2answers
1k views

Dumping SQLITE database out of memory and viewing without original DB

I am researching some malware which loads multiple Sqlite Databases into memory during its operation. I've managed to dump the memory to disk in a large block however I cannot view the databases ...
-3
votes
1answer
390 views

What exactly is a SIM card?

Does a SIM card consist of only Flash memory or is there a microprocessor inside as well?
2
votes
1answer
1k views

PE file format: How can I find the heap memory space in a running WinNT program?

I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
0
votes
1answer
927 views

Viewing Physical Memory Addresses in OllyDbg or any program?

I'm having a tough time finding any information at all concerning physical memory addresses and if/how I can get them from a program at runtime (Windows NT/10). When I run a program in OllyDbg and I'm ...
4
votes
2answers
992 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
1
vote
2answers
4k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
1
vote
0answers
883 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
4
votes
1answer
2k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
4
votes
1answer
1k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
0
votes
1answer
567 views

Wiring Flash Chip to Raspberry Pi

I'm trying to wire a Winbond W25Q128FV to my Rasberry Pi Model 1B so that I can dump the firmware. I'll be using an SOIC8 clip and probe cables. Here is what I'm thinking: Flash ----- rPi CS ----- ...
0
votes
2answers
276 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
1
vote
4answers
7k views

Determine NAND Flash chip type and dump contents

I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND ...
1
vote
0answers
771 views

OllyDbg: break on memory allocation?

In OllyDbg, is there a way to break when memory is allocated? Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/...
1
vote
0answers
804 views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
1
vote
0answers
245 views

Checksum reverse engineering help

I'm a newbie here, and I don't have a lot of experience with reverse engineering, so I'm asking for your help. I have dumped a Mifare Classic card several times, because I wanted to try understand ...
2
votes
1answer
338 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
1
vote
2answers
669 views

Heap address Calculation

I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process: 0:000> dt nt!_PEB 0106c000 ntdll!_PEB +0x000 InheritedAddressSpace : ...
0
votes
1answer
313 views

Is this anti-tamper solution fool-proof?

https://libreboot.org/faq/#intelme Introduced in June 2006 in Intel's 965 Express Chipset Family of (Graphics and) Memory Controller Hubs, or (G)MCHs, and the ICH8 I/O Controller Family, the Intel ...
3
votes
2answers
6k views

Tools for Windows 10 hiberfil.sys file analysis

As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened. Is there any tools (free, paid, open source, any) that ...
1
vote
3answers
938 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
1
vote
1answer
1k views

VirtualProtect return value

VirtualProtect is straightforward but I get some results that I can't explain. Something's going on in the background probably but I'd like to know what. The following is under Windows 7 SP1 Ultimate ...
1
vote
1answer
2k views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
2
votes
2answers
6k views

How to set a breakpoint on a 64 bit process button with x64dbg?

I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
3
votes
1answer
487 views

How to find address of more complicated, unknown data structures

I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory ...
1
vote
1answer
172 views

How would I go about imaging a propriatary flash or eeprom memory chip?

I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for ...
4
votes
2answers
1k views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
3
votes
1answer
281 views

Master of Orion and scanmem

I am looking to use scanmem to change in game credits in the new Master of Orion (2016). Steps I have taken: Install and run scanmem as root Track credits successfully using scanmem It ...
1
vote
0answers
134 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
2
votes
4answers
1k views

Target application crashes when using ReadProcessMemory

I have an interesting application that seems to crash whenever a particular region of memory is read using ReadProcessMemory. I know it's not doing anything special with RPM because: Injecting a DLL ...
0
votes
1answer
42 views

Is there a predictable interval between instructions of main methods in carbon?

Let's say I have a carbon objective-c executable, and a crash report. From the crash report, it is apparent that the main method is located at 0x00002639, and the NSApplicationMain method from the ...
0
votes
2answers
560 views

Trying to reverse assembly code of a game so i can write to memory

First of all, i want to say that this is not to be used for cheating in online games, or give me an advantage over other players, it is striclty for learning purposes, and games are fun. I have in a ...
1
vote
1answer
1k views

x64dbg and ollydbg error not enough memory

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
0
votes
1answer
153 views

Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program

I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below: The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
1
vote
1answer
168 views

Legal issue - Game Bot calling functions of copyrighted game [closed]

I spent some time reversing game client of one popular game. Found out multiple functions, ways to make character move, attack, reversed structures containing world data, and so created logic which ...
3
votes
2answers
3k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
2
votes
1answer
4k views

Process Dumping and Ida

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG. I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
2
votes
0answers
581 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
4
votes
1answer
3k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
1
vote
1answer
849 views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
3
votes
1answer
524 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
1
vote
1answer
686 views

Memory activity tracking

I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and ...
4
votes
2answers
777 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
1
vote
2answers
1k views

Are vTable pointers always located inside a module?

Assuming the standard VC++ vTable layout: Heap-Addr TableAddr +-----------+ +-----------+ | TableAddr | ----> | Funcion-1 | ----> Exec region of module +-----------+ +---...
3
votes
1answer
2k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
-1
votes
1answer
109 views

How to modify Data Section of an exe(DD x000455)?

005A45A6 > \83FE 50 CMP ESI,50 ; Switch (cases 0..50) 005A45A9 0F87 79150000 JA AcroByte.005A5B28 005A45AF . FF24B5 B6455A00 JMP DWORD PTR DS:[ESI*4+5A45B6]; AcroByte.005A46FA 005A45B6 . ...
2
votes
2answers
8k views

Tools to get started with reading memory during runtime

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic ...
4
votes
0answers
195 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
3
votes
2answers
1k views

How to identify code ran when clicking on an object in a game

I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
0
votes
0answers
47 views

Means of generating file hashes

I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I'...
3
votes
2answers
624 views

0x09-0x0d not taken into account with scanf

I've encountered something I can't explain. Here is the problem #include <stdio.h> #include <string.h> #include <stdlib.h> void ask() { char name[64]; printf("What is your ...