Questions tagged [virtual-memory]
The virtual-memory tag has no usage guidance.
11
questions
0
votes
1answer
33 views
How are processes assigned a virtual base address
So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
4
votes
1answer
109 views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
0
votes
0answers
36 views
Does IDA Support Segment Shadows/Aliases
Is it possible in IDA to map a single segment (block of code/data) to multiple addresses in a single address space (a much more limited solution to the problem would be to specify how many address ...
0
votes
0answers
28 views
What is the “Thread XXXX Stack” Section in x64dbg memory map?
So I am trying to understand how an Aegis Packed Malware works, and from what I am seeing the executable is passing the control to a section labelled Thread 2380 Stack after the EntryPoint. This ...
0
votes
1answer
124 views
Function Hooking via Dll Injection Negative Offset
I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
2
votes
1answer
587 views
RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz
This is not my expertise so forgive stupidity.
I have the following Firmware.
I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically ...
0
votes
1answer
45 views
How to protect memory area, not segment or page!
I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.
so if another thread accesses to that area, I want to generate exception.
To solve my problem, I've found and used ...
1
vote
2answers
80 views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
4
votes
2answers
898 views
What is this hidden stack used by syscalls on Windows?
I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
0
votes
2answers
712 views
Reading the process memory yields different results
I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
4
votes
1answer
1k views
/proc/self/maps equivalent on windows
I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.
How could one ...
