Questions tagged [virtual-memory]
The virtual-memory tag has no usage guidance.
14 questions
2
votes
1
answer
83
views
WinDbg command to retrieve TTBR registers for Aarch64?
Aarch64 architecture has the following registers, that contain physical base addresses for the virtual-to-physical translation tables for different exception levels:
TTBR0_EL1, TTBR1_EL1, TTBR0_EL2, ...
- 1,761
0
votes
0
answers
34
views
How does Windows determine dll address when using loadlibrary
First, sorry for my bad english.
I'm trying to make emulator to emulating PE binary with unicorn emulator.
My goal is place every dll in emulator that PE needed and hook some specific APIs.
What I am ...
- 63
1
vote
0
answers
237
views
ReadProcessMemory from host to Hyper-V Windows Guest VM
Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V?
The host is running Windows 11 the Guest is running ...
- 11
2
votes
1
answer
412
views
How to find "RawAddress" of a "VirtualAddress"?
I'm trying to parse a PE file manually as below:
1 ### DOS Header
2
3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
4 00000010: b800 0000 0000 0000 4000 0000 ...
- 207
0
votes
1
answer
151
views
How can a debugger break on dynamic loaded libraries?
I think I have a massive understanding problem with the following issue:
Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
- 35
0
votes
1
answer
620
views
How are processes assigned a virtual base address
So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
- 3
6
votes
1
answer
2k
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
0
votes
1
answer
281
views
Function Hooking via Dll Injection Negative Offset
I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
- 13
2
votes
1
answer
1k
views
RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz
This is not my expertise so forgive stupidity.
I have the following Firmware.
I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically ...
- 265
0
votes
1
answer
87
views
How to protect memory area, not segment or page!
I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.
so if another thread accesses to that area, I want to generate exception.
To solve my problem, I've found and used ...
1
vote
2
answers
112
views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
- 113
4
votes
2
answers
1k
views
What is this hidden stack used by syscalls on Windows?
I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
- 153
0
votes
2
answers
821
views
Reading the process memory yields different results
I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
user1743
4
votes
1
answer
2k
views
/proc/self/maps equivalent on windows
I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.
How could one ...
user1743