15
votes
Accepted
How does a SIM card work?
SIMs card are a type of Universal Integrated Circuit Card (UICC).
how exactly do they work
According to Karsten Nohl's presentation "Mobile Network Attack Evolution", SIM cards contain an embedded ...
- 6,829
13
votes
How does glibc malloc work?
For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented:
...
- 6,829
12
votes
Accepted
Where is ntdll.dll?
The code below will set EAX to the image base address of ntdll.dll:
MOV EAX, DWORD PTR FS:[30] ; EAX = PEB
MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr
MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX =...
- 20.4k
11
votes
\??\C:\ Question Marks in Paths
I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.
...
- 111
11
votes
What causes the need for NOP sleds?
On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
- 6,829
9
votes
Reverse engineering Perl-compatible regular-expressions
Googling for 0x50435245 gives several hits, for example here:
/* Magic number to provide a small check against being handed junk. Also used
to detect whether a pattern was compiled on a host of ...
- 34.6k
9
votes
Accepted
How to retrieve assembly from a raw memory dump?
Disassembling
You can disassemble in WinDbg at any memory address, e.g.
0:067> db 000007fe`ff4d0000
000007fe`ff4d0000 4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ..............
000007fe`...
- 950
9
votes
Accepted
Do all drivers exist in Kernel mode?
Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver ...
- 20.4k
9
votes
How does glibc malloc work?
There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow.
You can look at the ...
- 18k
8
votes
How does new operator internally work in C++?
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
- 34.6k
7
votes
Accepted
How does Ollydbg obtain the memory map (alt+m)?
VirtualQueryEx() can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory ...
- 20.4k
7
votes
Accepted
What's a good method to find the location of objects in a game
I'll make the assumption that the application is written in Visual C++.
CheatEngine itself is already pretty useful for finding your objects - first you need to find the place in code where these ...
- 231
7
votes
Accepted
Are vTable pointers always located inside a module?
Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
- 12.6k
7
votes
How to set a breakpoint on a 64 bit process button with x64dbg?
Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them.
After running the exe, go to Handles tab > ...
- 71
7
votes
Accepted
What is this hidden stack used by syscalls on Windows?
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
- 632
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
6
votes
Accepted
How can I make IDA start the analysis at imagebase?
PE executables start with a header block that consists of a little DOS exe stub (with its own little header), a structure called IMAGE_NT_HEADERS, and a section table. A normal PE has no 32-bit/64-bit ...
- 1,940
6
votes
Accepted
Dealing with instructions that are accessed by multiple pieces of data
The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic ...
- 2,144
6
votes
Accepted
Why there are only 8 hexa memory digits while my RAM is 16G
Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory ...
- 531
5
votes
Why is the value of the ESP register the same every time, when we turnoff the ASLR?
Because the operating system is initializing ESP always at the same value (and that the execution of the program you look at are deterministic).
The way the ASLR (Address-Space Layout Randomization) ...
- 18k
5
votes
Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?
This is a continuation of non-return based gadgets.
A ROP-gadget in itself is a segment of code that you can use to manipulate data, and get some desired effect, while maintaining control of ...
- 496
5
votes
Accepted
0x09-0x0d not taken into account with scanf
The scanf function skips over leading whitespace, with whitespace being the set of characters for which the isspace macro/function returns true.
In the standard locale, this set of characters ...
- 12.6k
5
votes
How to identify code ran when clicking on an object in a game
On windows you can
find winproc function, search click messages within it and add breakpoint/trace from there...
On different OS
trace mouse handlers ...
If OpenGL is used
The Object selection is ...
- 1,374
5
votes
Accepted
In-memory patching of .net code
Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm
High-level details and implementation for patching and ...
- 20.4k
5
votes
Accepted
Patching a string using DLL injection and OllyDbg
How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))?
A process doesn't have a base offset; I believe you mean the base ...
- 20.4k
5
votes
Accepted
Master of Orion and scanmem
This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
5
votes
Reading Physical Memory
I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault.
Correct. By design, all processes are ...
- 2,832
5
votes
Accepted
Can I set more than 4 memory access breakpoints in WinDbg?
Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
- 4,512
5
votes
Accepted
How to reverse engineer a setjmp/longjmp sequence?
I'll start with answering a few basic questions, some of which you didn't even ask!
What are segment registers doing in modern code?
It's been a while since we've needed extra registers to address a ...
- 11.3k
4
votes
Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?
Yes, all the opcodes ending by a ret can be considered as a gadget. But, consider also the fact that not only legal instructions can be considered as gadget, also 'starting in the middle of an ...
- 18k
Only top scored, non community-wiki answers of a minimum length are eligible