Questions tagged [memory]
Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.
236
questions
2
votes
3
answers
1k
views
Why is the value of the ESP register the same every time, when we turnoff the ASLR?
There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function ...
2
votes
0
answers
711
views
Flashing NVRAM with U-Boot 1.2.0
I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write:
tftp 0x80000100 nvram.bin
cp.b 0x80000100 0x007b0000 0x00050000
There is no error shown after cp.b command, ...
1
vote
1
answer
2k
views
Erase the data from the NVRAM
Cable modem SPI Flash memory have the following structure:
7 cmdlinepart partitions found on MTD device spansion
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }
...
2
votes
2
answers
2k
views
USB programmer for SPANSION S25FL064P flash memory
Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
1
vote
1
answer
323
views
How to reserve certain amount of memory and using segment register to access?
So basically I am trying to re-implement a memory protection technique, with the description like this:
A 256M segment is reserved for application code and
A 512M segment is reserved for some ...
1
vote
1
answer
98
views
How can force free part of memory in process? [closed]
I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ?
ZwFreeVirtualMemory(0,(LPVOID*)&(ImageBase),&(SizeOfImage),MEM_RELEASE );
9
votes
2
answers
5k
views
Where is ntdll.dll?
I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
2
votes
2
answers
751
views
Redirecting/Remapping/Rerouting a Memory Access
I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub:
.text:008EC420 ; ...
1
vote
1
answer
2k
views
Memory allocation on the stack
Here is a sample function reverse engineered from an easy program:
main proc near
var_70 = dword ptr -70h
var_6C = dword ptr -6Ch
var_68 = dword ptr -68h
i_2 ...
3
votes
1
answer
5k
views
How to edit an executable's ".data" segment?
This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information.
Anyway, I have two static classes ...
6
votes
2
answers
707
views
Reverse engineering Perl-compatible regular-expressions
I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
8
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
3
votes
3
answers
1k
views
Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?
So by reading this rop paper from Dr. Shacham, I know that it is not very hard to find gadgets set that has Turning-complete computation ability.
So I am thinking that, in theoretical, are all the ...
1
vote
1
answer
419
views
Ollydbg breakpoint causing application to perform differently without BP being hit
For the sake of this question I am going to simplify things. Basically I have a CMP that is comparing a memory address to a constant value. I want to change the constant value to force a match.
I ...
3
votes
1
answer
2k
views
Using Python pydbg - Find out what addresses does an instruction access
I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do?
The ...
4
votes
2
answers
2k
views
How does Ollydbg obtain the memory map (alt+m)? [closed]
I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online.
How would I get a dump of a process's memory like ...
7
votes
2
answers
7k
views
\??\C:\ Question Marks in Paths
I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability ...
2
votes
2
answers
428
views
Addressed changed by code from a common address
I have traced a static address which is using the base address and an offset.
I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as ...
3
votes
1
answer
2k
views
How to find memory addresses which are read from but not written to
Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...
Is there any such functionality in IDA ...
4
votes
1
answer
1k
views
Runtime memory reading with injection
I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application.
My desired values of that function are:
[ESP + 4] which ...
2
votes
2
answers
357
views
Issues writing a bootloader in x86 16-bit machine code
I am having trouble displaying simple text.
I am trying to do it all in machine code with INT 10h, but:
I can't find the binary opcode for INT 10h anywhere in the Intel Manual.
I can't figure out how ...
2
votes
2
answers
475
views
VADs with RWX permission in winlogon.exe process
On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
7
votes
2
answers
4k
views
Can a Windows process check if it has been injected by another process?
There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.
Is it possible for a process to somehow detect if it has been ...
6
votes
3
answers
6k
views
Does code injected into process memory always belong to a page with RWX access?
I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
6
votes
2
answers
5k
views
Break on returning to a specific module
I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
3
votes
2
answers
12k
views
Bypassing basic memory protection
I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory.
But ...
7
votes
1
answer
795
views
Modules that exist in a process address space
Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list)
This is just an ...
4
votes
0
answers
329
views
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.
...
2
votes
1
answer
721
views
Memory forensics: disabled pagefile but still not everything in memory
I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps.
I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump....
5
votes
2
answers
474
views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
5
votes
2
answers
1k
views
Automatic function naming
I'ld like to know how to bulk rename functions in IDA, based on some condition.
Example:
Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
4
votes
1
answer
326
views
Weird instructions
In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace:
RIP register ...
5
votes
1
answer
549
views
Differences in memory dumps of executable data
I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection.
Mainly I try to ...
19
votes
2
answers
15k
views
How to predict address space layout differences between real and gdb-controlled executions?
It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one.
But, here is an example:
First, here is ...
7
votes
3
answers
11k
views
Paste hex bytes into IDA Pro Hex View
Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
10
votes
1
answer
1k
views
What does this memory pattern pointing from the thread-local storage mean?
An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0).
First question would be, where can I ...