Questions tagged [memory]

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

Filter by
Sorted by
Tagged with
2 votes
3 answers
1k views

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function ...
trawgs's user avatar
  • 21
2 votes
0 answers
711 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
Lexx Luxx's user avatar
  • 203
1 vote
1 answer
2k views

Erase the data from the NVRAM

Cable modem SPI Flash memory have the following structure: 7 cmdlinepart partitions found on MTD device spansion partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) } ...
Lexx Luxx's user avatar
  • 203
2 votes
2 answers
2k views

USB programmer for SPANSION S25FL064P flash memory

Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
Lexx Luxx's user avatar
  • 203
1 vote
1 answer
323 views

How to reserve certain amount of memory and using segment register to access?

So basically I am trying to re-implement a memory protection technique, with the description like this: A 256M segment is reserved for application code and A 512M segment is reserved for some ...
lllllllllllll's user avatar
1 vote
1 answer
98 views

How can force free part of memory in process? [closed]

I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ? ZwFreeVirtualMemory(0,(LPVOID*)&(ImageBase),&(SizeOfImage),MEM_RELEASE );
user2522767's user avatar
9 votes
2 answers
5k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
Dirk's user avatar
  • 443
2 votes
2 answers
751 views

Redirecting/Remapping/Rerouting a Memory Access

I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub: .text:008EC420 ; ...
Zarathos's user avatar
  • 185
1 vote
1 answer
2k views

Memory allocation on the stack

Here is a sample function reverse engineered from an easy program: main proc near var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h i_2 ...
upton's user avatar
  • 226
3 votes
1 answer
5k views

How to edit an executable's ".data" segment?

This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information. Anyway, I have two static classes ...
Zarathos's user avatar
  • 185
6 votes
2 answers
707 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
Thomas Chopitea's user avatar
8 votes
2 answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
Zarathos's user avatar
  • 185
3 votes
3 answers
1k views

Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?

So by reading this rop paper from Dr. Shacham, I know that it is not very hard to find gadgets set that has Turning-complete computation ability. So I am thinking that, in theoretical, are all the ...
lllllllllllll's user avatar
1 vote
1 answer
419 views

Ollydbg breakpoint causing application to perform differently without BP being hit

For the sake of this question I am going to simplify things. Basically I have a CMP that is comparing a memory address to a constant value. I want to change the constant value to force a match. I ...
GuYY's user avatar
  • 65
3 votes
1 answer
2k views

Using Python pydbg - Find out what addresses does an instruction access

I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do? The ...
A.Sherif's user avatar
4 votes
2 answers
2k views

How does Ollydbg obtain the memory map (alt+m)? [closed]

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online. How would I get a dump of a process's memory like ...
douggard's user avatar
  • 193
7 votes
2 answers
7k views

\??\C:\ Question Marks in Paths

I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability ...
user4089's user avatar
2 votes
2 answers
428 views

Addressed changed by code from a common address

I have traced a static address which is using the base address and an offset. I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as ...
Syncretic's user avatar
3 votes
1 answer
2k views

How to find memory addresses which are read from but not written to

Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses... Is there any such functionality in IDA ...
Milind R's user avatar
  • 203
4 votes
1 answer
1k views

Runtime memory reading with injection

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. My desired values of that function are: [ESP + 4] which ...
Dominik Antal's user avatar
2 votes
2 answers
357 views

Issues writing a bootloader in x86 16-bit machine code

I am having trouble displaying simple text. I am trying to do it all in machine code with INT 10h, but: I can't find the binary opcode for INT 10h anywhere in the Intel Manual. I can't figure out how ...
Tomahawker's user avatar
2 votes
2 answers
475 views

VADs with RWX permission in winlogon.exe process

On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
user3365's user avatar
  • 197
7 votes
2 answers
4k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...
Benny's user avatar
  • 828
6 votes
3 answers
6k views

Does code injected into process memory always belong to a page with RWX access?

I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
Benny's user avatar
  • 828
6 votes
2 answers
5k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
Dominik Antal's user avatar
3 votes
2 answers
12k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
Ahmad Hafiz's user avatar
7 votes
1 answer
795 views

Modules that exist in a process address space

Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list) This is just an ...
user3365's user avatar
  • 197
4 votes
0 answers
329 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
user3365's user avatar
  • 197
2 votes
1 answer
721 views

Memory forensics: disabled pagefile but still not everything in memory

I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps. I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump....
user3365's user avatar
  • 197
5 votes
2 answers
474 views

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
Dominik Antal's user avatar
5 votes
2 answers
1k views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
Dominik Antal's user avatar
4 votes
1 answer
326 views

Weird instructions

In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace: RIP register ...
Ta Thanh Dinh's user avatar
5 votes
1 answer
549 views

Differences in memory dumps of executable data

I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection. Mainly I try to ...
Nordwald's user avatar
  • 2,896
19 votes
2 answers
15k views

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
perror's user avatar
  • 19.1k
7 votes
3 answers
11k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
Ditmar Wendt's user avatar
10 votes
1 answer
1k views

What does this memory pattern pointing from the thread-local storage mean?

An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0). First question would be, where can I ...
samuirai's user avatar
  • 3,079

1 2 3 4
5