Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
3
votes
2answers
623 views

0x09-0x0d not taken into account with scanf

I've encountered something I can't explain. Here is the problem #include <stdio.h> #include <string.h> #include <stdlib.h> void ask() { char name[64]; printf("What is your ...
1
vote
1answer
273 views

Determining checksum algorithm from known values

I've been analyzing some SPI EEPROM memory, and tried to find out which Checksum algorithm has been used; For example I've got data: 14567D9h and checksum 187h. Assuming it's normal 16 bit check sum ...
2
votes
2answers
269 views

Defining Pointers outside the Target Proccess Memory Space

I am making a memory editor for an application written in Python. I've successfully grabbed the memory data from the target process using OpenProcess and ReadProcessMemory functions from the kernel32....
0
votes
0answers
587 views

Getting “Access violation executing location” error

I am trying to execute this assembly function. But after calling Test_init function, I am getting "Access violation executing location" error at line "add esp,4". sub_402110 proc near ; ...
7
votes
2answers
5k views

How to retrieve assembly from a raw memory dump?

I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory. I'm looking for a tool that will help me identify ...
2
votes
0answers
393 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
1
vote
0answers
203 views

Scanning memory accessed by a DLL

I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to ...
0
votes
1answer
369 views

Process termimates after attaching

I am using ollydbg and whenever i attach ollydbg to running process (in this case it's game and it has xtrap) this game terminates all threads and nothing is shown in olly . And when i use ...
0
votes
1answer
1k views

Can either volatility or GDB dump only the heap memory of a process under Linux?

What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or ...
4
votes
1answer
2k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
4
votes
1answer
950 views

What's a good method to find the location of objects in a game [closed]

So in a given game there are objects randomly placed around the map. I've managed (through playing with the memory in cheat engine) find that a single value changes when a certain object is within my ...
0
votes
2answers
2k views

Automatically list of mapped memory locations(and their attributes) of a running process

I am trying to obtain the memory map of a process. One way I can think of doing this is to attach Olly/Immunity Debugger to the process and copy the memory map to the clipboard. However, this is ...
1
vote
1answer
450 views

Stack frame boundary

I've disassembled some C/C++ codes and realized the stack boundary is specified at beginning of a procedure, somehow like this : 1. push ebp 2. mov ebp , esp 3. sub esp , <power> ; <power>...
2
votes
1answer
2k views

How can I make IDA start the analysis at imagebase?

I noticed that despite the imagebase for win32 executables be 0x400000, Ida Pro only starts the analysis at 0x401000. What is before that and how can I change IDA's settings to start the analysis at ...
2
votes
0answers
625 views

How to dump iPhone arm64 memory? [closed]

Since GDB is no longer supported on arm64 devices i can't figure any alternative except lldb with debugserver, but unfortunately i can't dump memory with read command always giving me different errors,...
2
votes
3answers
3k views

tools - Free Windows Memory Toolkit for x64

I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out ...
3
votes
1answer
1k views

Obtaining MmNonPagedPoolStart on x64 systems

On a x64 Windows 7 I want to get the limits of non paged pool. I know that _KDDEBUGGER_DATA64 structure has this information (fields like MmNonPagedPoolStart and MmNonPagedPoolEnd). On x86 systems ...
2
votes
0answers
1k views

Map virtual addresses to physical addresses

I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
1
vote
2answers
897 views

Page Directory Pointer Table in WinDbg

The !pte command in WinDbg gives all the information one may need regarding a virtual address (PDE and PTE location and content), but even on systems with PAE it says nothing about the Page Directory ...
2
votes
1answer
321 views

Break on memory access on Android

I want to be able to monitor when a memory address is read from on Android. The binary I am studying stores around 60 bytes to a memory location during initialisation and this buffer is used at some ...
-1
votes
1answer
379 views

Help old gamecube file format

I'm trying to figure out how this .RBB file is packed it's from a gamecube game I'm trying to learn how to reverse engineer it so I can extract the file and look at its contents. I don't know were ...
0
votes
1answer
2k views

Why ELF headers are included in the process memory

The running process has nothing to do with the program headers but when we print the address(0x08048000) we can see the ELF header starting with "\x7fELF..". It looks like so much of page memory is ...
2
votes
3answers
1k views

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function ...
2
votes
0answers
688 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
1answer
2k views

Erase the data from the NVRAM

Cable modem SPI Flash memory have the following structure: 7 cmdlinepart partitions found on MTD device spansion partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) } ...
2
votes
2answers
2k views

USB programmer for SPANSION S25FL064P flash memory

Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
1
vote
1answer
273 views

How to reserve certain amount of memory and using segment register to access?

So basically I am trying to re-implement a memory protection technique, with the description like this: A 256M segment is reserved for application code and A 512M segment is reserved for some ...
1
vote
1answer
94 views

How can force free part of memory in process? [closed]

I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ? ZwFreeVirtualMemory(0,(LPVOID*)&(ImageBase),&(SizeOfImage),MEM_RELEASE );
9
votes
2answers
4k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
2
votes
2answers
595 views

Redirecting/Remapping/Rerouting a Memory Access

I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub: .text:008EC420 ; ...
1
vote
1answer
2k views

Memory allocation on the stack

Here is a sample function reverse engineered from an easy program: main proc near var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h i_2 ...
3
votes
1answer
4k views

How to edit an executable's “.data” segment?

This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information. Anyway, I have two static classes ...
6
votes
2answers
645 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
3
votes
3answers
968 views

Are all the code sequences ended with “ret” potential “gadgets” for ROP attack?

So by reading this rop paper from Dr. Shacham, I know that it is not very hard to find gadgets set that has Turning-complete computation ability. So I am thinking that, in theoretical, are all the ...
1
vote
1answer
384 views

Ollydbg breakpoint causing application to perform differently without BP being hit

For the sake of this question I am going to simplify things. Basically I have a CMP that is comparing a memory address to a constant value. I want to change the constant value to force a match. I ...
3
votes
1answer
2k views

Using Python pydbg - Find out what addresses does an instruction access

I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do? The ...
4
votes
2answers
2k views

How does Ollydbg obtain the memory map (alt+m)? [closed]

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online. How would I get a dump of a process's memory like ...
6
votes
2answers
5k views

\??\C:\ Question Marks in Paths

I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability ...
2
votes
2answers
370 views

Addressed changed by code from a common address

I have traced a static address which is using the base address and an offset. I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as ...
2
votes
1answer
2k views

How to find memory addresses which are read from but not written to

Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses... Is there any such functionality in IDA ...
3
votes
1answer
1k views

Runtime memory reading with injection

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. My desired values of that function are: [ESP + 4] which ...
1
vote
2answers
328 views

Issues writing a bootloader in x86 16-bit machine code

I am having trouble displaying simple text. I am trying to do it all in machine code with INT 10h, but: I can't find the binary opcode for INT 10h anywhere in the Intel Manual. I can't figure out how ...
1
vote
2answers
392 views

VADs with RWX permission in winlogon.exe process

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
7
votes
2answers
3k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...
6
votes
3answers
5k views

Does code injected into process memory always belong to a page with RWX access?

I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
6
votes
2answers
4k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
2
votes
2answers
12k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
6
votes
1answer
670 views

Modules that exist in a process address space

Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list) This is just an ...
3
votes
0answers
315 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...