15
There could be other factors involved, but my guess would be that changes in the process environment variables, which are stored on the stack, are what's causing this issue.
Running a small program that just prints out the environment variables reveals a couple variations in environment variables when run inside vs outside gdb on my system.
int main(int ...
15
SIMs card are a type of Universal Integrated Circuit Card (UICC).
how exactly do they work
According to Karsten Nohl's presentation "Mobile Network Attack Evolution", SIM cards contain an embedded real-time operating system, a filesystem and a Java VM:
Here is the technical specification for UICCs, which describes exactly how they work:
ETSI TS 102 ...
12
The code below will set EAX to the image base address of ntdll.dll:
MOV EAX, DWORD PTR FS:[30] ; EAX = PEB
MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr
MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB->Ldr.InInitializationOrderModuleList.Flink
MOV EAX, DWORD PTR DS:[EAX+8] ; EAX = image base of ntdll (LDR_MODULE's BaseAddress)
Based on your ...
10
I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.
The above answer is referring to non-canonicalized device paths where as you are asking about \??\ not \\?\ there may only be a small difference in the question ...
10
For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented:
comments on chunks:
/*
1056 malloc_chunk details:
1057
1058 (The following includes lightly edited explanations by Colin Plumb.)
1059
1060 ...
9
This is code from the vDSO which is mapped by the kernel into every process, not from the wget binary. You could probably figure it out by inspecting the /proc/<pid>/maps file.
Here's what I have in IDA for gettimeofday from it:
.text:FFFFFFFFFF700D17 mov rbx, 0FFFFFFFFFFDFF000h
.text:FFFFFFFFFF700D1E lsl r11d, eax
.text:FFFFFFFFFF700D22 ...
9
The IDAScope plugin has similar functionality to rename functions based on the Windows API functions they are calling. You can find a standalone script here that does that http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html it should give you an idea how to implement what you are looking for.
9
Googling for 0x50435245 gives several hits, for example here:
/* Magic number to provide a small check against being handed junk. Also used
to detect whether a pattern was compiled on a host of different endianness. */
#define MAGIC_NUMBER 0x50435245UL /* 'PCRE' */
<...snip...>
/* The real format of the start of the pcre block; the index of ...
9
Disassembling
You can disassemble in WinDbg at any memory address, e.g.
0:067> db 000007fe`ff4d0000
000007fe`ff4d0000 4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ..............
000007fe`ff4d0010 b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00 ........@.......
000007fe`ff4d0020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
...
9
Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality.
What we typically think of as a "driver" is a ...
9
There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow.
You can look at the following lectures for a simplified approach of the heap management (using the Protostar exercise set from Exploit-Exercises):
0x14 - The Heap: what does malloc() ...
9
On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely implemented. This was alluded to in AlephOne's venerable "Smashing the Stack for Fun and Profit":
The problem we are faced when trying to overflow the buffer of ...
8
While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc.PatchByte / idc.PatchWord / idc.PatchDword to change bytes in the IDA database.
EDIT:
Just a quick note, if you want your patches applied to the original file ...
8
The area you're looking at is something specific to the program; it's not part of Windows structures.
The value at fs:[0x2C] is the TLS array - array of pointers to the thread-specific blocks of variables somewhere in the program's memory. Here's how a typical TLS access to a __declspec(thread) variable looks like:
mov eax, DWORD PTR __tls_index ; load ...
8
The assumption does not hold true, as it is possible to alter page protection flags after you've allocated memory.
The usual mechanism for code injection on Windows is as follows:
Call OpenProcess for the target process, to get a handle that has appropriate access privileges.
Use VirtualAllocEx to allocate a buffer in the target process, with a set of ...
8
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics regarding new expressions and the sequence of construction/destructions of classes and their members are described in the C++ standard (a nice summary is available at ...
7
Injected code could represented by, but not limited to:
Remotely created thread could be detected by several techniques:
Periodically check if process threads were created by current process using NtQueryProcessInformation.
For each thread check if it is running from the address space of the original executable and not from some orphaned memory page:
...
7
Go to the memory window in Ollydbg. Find the code section (usually .text) of the module you want to break on return to. Right click the memory section and set break-on-access or hit F2. You'll break once execution reaches that memory. You can also change the memory access to read only and you'll get an exception when execution hits that memory segment.
You ...
7
VirtualQueryEx() can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory blocks are associated with which PE sections. PE headers for DLLs also contain the DLLs' names.
7
I'll make the assumption that the application is written in Visual C++.
CheatEngine itself is already pretty useful for finding your objects - first you need to find the place in code where these objects are created. For example in C++ you'd write:
GameObject* obj = new GameObject();
In assembly this is often inlined to a malloc call. So if you use ...
7
Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method within the object itself; the new operator initialized each of these function pointers separately, every time it generated a new object.
The very idea of the ...
answered Oct 12 '15 at 6:36
Guntram Blohm supports Monica
12.1k1 gold badge17 silver badges31 bronze badges
7
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll does not make system calls. Where the native 32-bit ntdll would sysenter (via an indirect call to SharedUserData!SystemCallStub) the WOW64 ntdll has an ...
7
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go binaries, you can choose for your application-specific solution from below.
There is no decompiling tool available for Go language. Although according to this ...
6
The netapi.dll might have loaded the dnsapi.dll in order to do some network inspection, and then freed the DLL on completion. However, the shlwapi.dll might hold some handles to objects open for whatever reason, or have a non-zero reference count because of circular loading, and thus remain in memory even after the other DLLs have unloaded. A request to ...
6
PE executables start with a header block that consists of a little DOS exe stub (with its own little header), a structure called IMAGE_NT_HEADERS, and a section table. A normal PE has no 32-bit/64-bit executable code there, so IDA doesn't load the header block unless you check "manual load".
Relevant resources:
Microsoft's PE COFF specification (currently ...
6
Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has virtual memory space covering possibly the entire address space but mapped to a limited section of physical memory. ...
5
One way that a process can detect the presence of injected threads is by the use of Thread Local Storage. When a thread is injected, the host's Thread Local Storage callbacks will be called unless the injector takes care to disable that. If the callbacks are called, then the host can query the start address of the new thread and determine if it is within ...
5
To call an interrupt, you'll probably want to use int imm8 which is encoded as 0xcd, 0xnn (0x10 in this case).
For bootloaders, it's pretty common to stick the data in between the jmp at the start of the bootloader and its target. You don't really need to mess around with ds unless you're making a very large bootloader (which loads additional sectors from ...
5
This is a continuation of non-return based gadgets.
A ROP-gadget in itself is a segment of code that you can use to manipulate data, and get some desired effect, while maintaining control of execution. Here is a paper about Jump Oriented Programming. Also, Return Oriented Programming without Returns. They went through libc-2.7 (/lib/i686/cmov/libc-2.7.so of ...
5
Because the operating system is initializing ESP always at the same value (and that the execution of the program you look at are deterministic).
The way the ASLR (Address-Space Layout Randomization) works for stack randomization is very simple. At program start, the operating system, when initializing the ESP register, will add a random value to it.
When ...
Only top voted, non community-wiki answers of a minimum length are eligible
