Hot answers tagged

17 votes
Accepted

How does a SIM card work?

SIMs card are a type of Universal Integrated Circuit Card (UICC). how exactly do they work According to Karsten Nohl's presentation "Mobile Network Attack Evolution", SIM cards contain an embedded ...
julian's user avatar
  • 7,078
15 votes

How does glibc malloc work?

For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented: ...
julian's user avatar
  • 7,078
14 votes

\??\C:\ Question Marks in Paths

I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here. ...
woffles2.0's user avatar
11 votes

What causes the need for NOP sleds?

On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
julian's user avatar
  • 7,078
10 votes

How does glibc malloc work?

There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow. You can look at the ...
perror's user avatar
  • 18.9k
9 votes
Accepted

Do all drivers exist in Kernel mode?

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver ...
Jason Geffner's user avatar
8 votes

How does new operator internally work in C++?

This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
Igor Skochinsky's user avatar
  • 36.4k
7 votes
Accepted

Are vTable pointers always located inside a module?

Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
Guntram Blohm's user avatar
7 votes

How to set a breakpoint on a 64 bit process button with x64dbg?

Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them. After running the exe, go to Handles tab > ...
ThunderCls's user avatar
7 votes
Accepted

What is this hidden stack used by syscalls on Windows?

This doesn't happen during the system call. It happens in user-mode. WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
conio's user avatar
  • 632
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
Kerim Can Kalıpcıoğlu's user avatar
6 votes
Accepted

Dealing with instructions that are accessed by multiple pieces of data

The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic ...
dsasmblr's user avatar
  • 2,234
6 votes
Accepted

Why there are only 8 hexa memory digits while my RAM is 16G

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory ...
multithr3at3d's user avatar
5 votes
Accepted

Master of Orion and scanmem

This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
Sebastian Parschauer's user avatar
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
Jason Geffner's user avatar
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
Jason Geffner's user avatar
5 votes

Reading Physical Memory

I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault. Correct. By design, all processes are ...
PhoeniX's user avatar
  • 3,002
5 votes
Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
Paweł Łukasik's user avatar
5 votes
Accepted

Do all games have static base addresses for values like gold and energy?

Almost static address can be achieved when the developer use global or static variables. While this was somewhat popular in the old days, today it is very rare and also considered a bad practice. ...
Yennefer's user avatar
  • 297
5 votes
Accepted

How to reverse engineer a setjmp/longjmp sequence?

I'll start with answering a few basic questions, some of which you didn't even ask! What are segment registers doing in modern code? It's been a while since we've needed extra registers to address a ...
NirIzr's user avatar
  • 11.7k
4 votes

How to predict address space layout differences between real and gdb-controlled executions?

Just to add to the answers, I can tell how to get close to a clean environment despite gdb. In fact, there are two methods to reach this: We can get rid of the extra environment variables added by ...
perror's user avatar
  • 18.9k
4 votes
Accepted

CreateProcess - First thread routine - where is the memory allocated for the thread?

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation ...
user1354557's user avatar
  • 1,234
4 votes

Is it possible ( or how) to dump source code/machine code from memory?

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
Nordwald's user avatar
  • 2,896
4 votes
Accepted

Is it possible copy and save bootloader using CLI telnet commands?

The bootloader is in the flash, so you have to dump it first by using: dd if=/dev/mtd0 of=/tmp/mtd0 or nandump -of /tmp/mtd0 /dev/mtd0 After it you have to copy to an SD card, USB device or send ...
ebux's user avatar
  • 1,759
4 votes
Accepted

PE file format: How can I find the heap memory space in a running WinNT program?

Short answer: The heap, stack and other PE loader related tasks are not part of the PE standard or definition. General Information the PE file does not describe the entire memory space of an ...
NirIzr's user avatar
  • 11.7k
4 votes

Volatility - manually inspect heap of a process

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. ...
knx's user avatar
  • 1,257
4 votes

How can I find my variables in the running process?

Your std::string is not a plain ascii string it is a structure (actually a class) so you cannot take the address and find the string. In your specific case since your string test's length is less ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

The C166 family code meaning

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - ...
Sparkette's user avatar
  • 166
4 votes
Accepted

Load process from memory dump

What you want exists and is known -- among other terms -- under the term "time travel debugging" (TTD), "replay debugging" and "record and replay debugging". Your ...
0xC0000022L's user avatar
  • 10.9k
3 votes

How would I go about imaging a propriatary flash or eeprom memory chip?

I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of: detect/exploit/sniff known interface Like SPI,JTAG,... or even memory interface (address,...
Spektre's user avatar
  • 1,384

Only top scored, non community-wiki answers of a minimum length are eligible