All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
1
vote
1answer
213 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
1
vote
1answer
146 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
1
vote
0answers
256 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
2
votes
3answers
906 views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
0
votes
2answers
210 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
0
votes
1answer
140 views

Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program

I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below: The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
1
vote
1answer
577 views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
0
votes
1answer
1k views

Why ELF headers are included in the process memory

The running process has nothing to do with the program headers but when we print the address(0x08048000) we can see the ELF header starting with "\x7fELF..". It looks like so much of page memory is ...
1
vote
1answer
242 views

How to reserve certain amount of memory and using segment register to access?

So basically I am trying to re-implement a memory protection technique, with the description like this: A 256M segment is reserved for application code and A 512M segment is reserved for some ...