Questions tagged [virtual-memory]
The virtual-memory tag has no usage guidance.
13
questions
0
votes
0
answers
13
views
How are system page map entries belonging to process's updated?
Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
1
vote
0
answers
45
views
ReadProcessMemory from host to Hyper-V Windows Guest VM
Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V?
The host is running Windows 11 the Guest is running ...
- 11
2
votes
1
answer
79
views
How to find "RawAddress" of a "VirtualAddress"?
I'm trying to parse a PE file manually as below:
1 ### DOS Header
2
3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
4 00000010: b800 0000 0000 0000 4000 0000 ...
- 187
0
votes
1
answer
32
views
How can a debugger break on dynamic loaded libraries?
I think I have a massive understanding problem with the following issue:
Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
- 3
0
votes
1
answer
139
views
How are processes assigned a virtual base address
So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
- 3
6
votes
1
answer
798
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
0
votes
1
answer
193
views
Function Hooking via Dll Injection Negative Offset
I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
- 13
2
votes
1
answer
917
views
RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz
This is not my expertise so forgive stupidity.
I have the following Firmware.
I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically ...
- 255
0
votes
1
answer
52
views
How to protect memory area, not segment or page!
I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.
so if another thread accesses to that area, I want to generate exception.
To solve my problem, I've found and used ...
1
vote
2
answers
88
views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
- 113
4
votes
2
answers
1k
views
What is this hidden stack used by syscalls on Windows?
I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
- 153
0
votes
2
answers
774
views
Reading the process memory yields different results
I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
user1743
4
votes
1
answer
2k
views
/proc/self/maps equivalent on windows
I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.
How could one ...
user1743