Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Favorites |
infavorites:mine infavorites:1234 |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.
2
votes
for va to phys address translation there is a windbg bang command
!vtop 0 < VirtualAddress > .
a sample output from that command below
kd> !vtop 0 403000
X86VtoP: Virt 00403000, pagedir 11800480
X8 …
answered Oct 9 '14 by blabb
1
vote
nt!KdDebuggerDatablock used to be a public global symbol in NT
lkd> x/v nt!KdDebuggerDataBlock
pub global 80545b60 0 nt!KdDebuggerDataBlock = <no type information>
dpS nt!KdDebuggerDa …
answered Oct 17 '14 by blabb
2
votes
The image in query cant be viewed.
i assume you are asking ----
why i cant see the assembly code pertaining to my code portion only
and what are those extra assembly code which i didnt seem …
answered Aug 8 '18 by blabb
4
votes
In normal condition alt+f9 execute till user code should get you back to user code
answered Jan 8 '14 by blabb
4
votes
Assuming you want to see it in Windbg.
You can follow this walk through for each pointer points to successive LDR_DATA_TABLE_ENTRY the output is from calc.exe.
0:000> dt ntdll!_LDR_DATA_TABLE_ENTRY …
answered May 28 '14 by blabb
2
votes
There seems to be a local array on the stack frame that takes up 78h =
120d bytes on the stack, indicated by this line :
no the local var is of type int and it takes 4 bytes on 32 bit machine
i …
answered Sep 12 by blabb
2
votes
way to find out the address in your setup could be to search the dump for the specific DWORD that is shown in !vad output a RWX page in winlogon memory a sample of which is also pasted below
kd> kb … execution is happening
try !vad on winlogon and confirm if it is RWX and search winlogon memory
kd> dd 01072b04 l4
01072b04 968dab54 00000002 02f70000 00000000
kd> !process 0 0 winlogon.exe
PROCESS …
answered Jan 28 '14 by blabb
0
votes
execute this bat file you will need windbg in path
it attaches to a running process (hard coded as calc.exe you can script it with %1) dumps the memory map filtered by page_readonly and mapped …
answered Mar 11 '15 by blabb
0
votes
windows > greater than vista implement a security feature called ASLR (Address Space Layout Randomisation )
this feature randomly changes the Base Address of the binary each time it is restarted th …
answered Mar 27 '18 by blabb
1
vote
well if you can use a debugger then you can employ a variety of monitoring techniques.
The example below is for a windows app being debugged by windbg.
but gdb is equally versatile and you should …
answered Aug 10 '17 by blabb
4
votes
1 ) your std::string is not a plain ascii string it is a structure (actually a class)
so you cannot take the address and find the string
in your specific case since your string test 's length is le …
answered Feb 19 by blabb
2
votes
this is from win7 but that shouldn't matter much
ProcessHeap From Peb of current Process
0:000> dt ntdll!_PEB ProcessHeap @$proc
+0x018 ProcessHeap : 0x00430000 Void
heap Stat For the same …
answered Oct 16 '16 by blabb
0
votes
There Are Many Apis that can help you locate the pertinent windows
the simplest being FindWindow And GetWindowText
you can run a complete enumeration with EnumWindows using A user provided callback fu …
answered Oct 8 by blabb
