Questions tagged [virtual-memory]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
1answer
99 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
4
votes
2answers
886 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
4
votes
1answer
1k views

/proc/self/maps equivalent on windows

I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in. How could one ...
2
votes
1answer
570 views

RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz

This is not my expertise so forgive stupidity. I have the following Firmware. I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically ...
1
vote
2answers
80 views

Can a Data Type Span Multiple Virtual Pages? (Windows)

Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows? ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
0
votes
1answer
32 views

How are processes assigned a virtual base address

So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
0
votes
1answer
45 views

How to protect memory area, not segment or page!

I want to protect the certain memory area, like 0x12345678 ~ 0x12345679. so if another thread accesses to that area, I want to generate exception. To solve my problem, I've found and used ...
0
votes
2answers
711 views

Reading the process memory yields different results

I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
0
votes
0answers
36 views

Does IDA Support Segment Shadows/Aliases

Is it possible in IDA to map a single segment (block of code/data) to multiple addresses in a single address space (a much more limited solution to the problem would be to specify how many address ...
0
votes
0answers
27 views

What is the “Thread XXXX Stack” Section in x64dbg memory map?

So I am trying to understand how an Aegis Packed Malware works, and from what I am seeing the executable is passing the control to a section labelled Thread 2380 Stack after the EntryPoint. This ...
0
votes
1answer
124 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...