Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 10027

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

5
votes
PE executables start with a header block that consists of a little DOS exe stub (with its own little header), a structure called IMAGE_NT_HEADERS, and a section table. A normal PE has no 32-bit/64-bit …
answered Jan 30 '15 by DarthGizka
2
votes
Mark Russinovich's SysInternals suite contains a utility named VMMap, which can be used to view the memory layout of a process and/or dump the information in various formats. As Brendan mentioned … /C++. Note: the memory layout is not static. Stacks can grow, sections can be unmapped, blocks allocated or freed, reserved space be committed, valid pages be made inaccessible. Depending on the …
answered Mar 11 '15 by DarthGizka
0
votes
Things will invariably be messy if you simulate only the (memory) environment but try to have instructions executed natively, regardless of whether you use single-step mode or page faulting …
answered Dec 31 '16 by DarthGizka
1
vote
first instruction byte with CC and wait for the interrupt. Then they write back the original instruction byte. The hexdump of the memory area around [edx] definitely looks like code, and the bytes … loaded into ebx look like push opcodes. So it seems reasonable to suppose that either IDA is playing around with int 3 or someone else does... If your target program is aliasing memory then this could explain the whole confusion. …
answered Apr 24 '16 by DarthGizka