Questions tagged [virtual-memory]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

How are system page map entries belonging to process's updated?

Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
user avatar
1 vote
0 answers
45 views

ReadProcessMemory from host to Hyper-V Windows Guest VM

Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V? The host is running Windows 11 the Guest is running ...
user avatar
  • 11
2 votes
1 answer
79 views

How to find "RawAddress" of a "VirtualAddress"?

I'm trying to parse a PE file manually as below: 1 ### DOS Header 2 3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 4 00000010: b800 0000 0000 0000 4000 0000 ...
user avatar
0 votes
1 answer
32 views

How can a debugger break on dynamic loaded libraries?

I think I have a massive understanding problem with the following issue: Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
user avatar
  • 3
0 votes
1 answer
139 views

How are processes assigned a virtual base address

So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
user avatar
  • 3
6 votes
1 answer
798 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
user avatar
  • 61
0 votes
1 answer
193 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
user avatar
2 votes
1 answer
917 views

RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz

This is not my expertise so forgive stupidity. I have the following Firmware. I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically ...
user avatar
0 votes
1 answer
52 views

How to protect memory area, not segment or page!

I want to protect the certain memory area, like 0x12345678 ~ 0x12345679. so if another thread accesses to that area, I want to generate exception. To solve my problem, I've found and used ...
user avatar
1 vote
2 answers
88 views

Can a Data Type Span Multiple Virtual Pages? (Windows)

Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows? ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
user avatar
4 votes
2 answers
1k views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
user avatar
  • 153
0 votes
2 answers
774 views

Reading the process memory yields different results

I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
user avatar
4 votes
1 answer
2k views

/proc/self/maps equivalent on windows

I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in. How could one ...
user avatar