17
votes
Accepted
How does a SIM card work?
SIMs card are a type of Universal Integrated Circuit Card (UICC).
how exactly do they work
According to Karsten Nohl's presentation "Mobile Network Attack Evolution", SIM cards contain an embedded ...
- 7,078
15
votes
How does glibc malloc work?
For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented:
...
- 7,078
14
votes
\??\C:\ Question Marks in Paths
I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.
...
- 141
11
votes
What causes the need for NOP sleds?
On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
- 7,078
10
votes
How does glibc malloc work?
There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow.
You can look at the ...
- 18.9k
9
votes
Accepted
Do all drivers exist in Kernel mode?
Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver ...
- 20.7k
8
votes
How does new operator internally work in C++?
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
- 36.4k
7
votes
Accepted
Are vTable pointers always located inside a module?
Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
- 12.9k
7
votes
How to set a breakpoint on a 64 bit process button with x64dbg?
Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them.
After running the exe, go to Handles tab > ...
- 71
7
votes
Accepted
What is this hidden stack used by syscalls on Windows?
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
- 632
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
6
votes
Accepted
Dealing with instructions that are accessed by multiple pieces of data
The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic ...
- 2,234
6
votes
Accepted
Why there are only 8 hexa memory digits while my RAM is 16G
Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory ...
- 609
5
votes
Accepted
Master of Orion and scanmem
This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
5
votes
Accepted
Patching a string using DLL injection and OllyDbg
How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))?
A process doesn't have a base offset; I believe you mean the base ...
- 20.7k
5
votes
Accepted
In-memory patching of .net code
Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm
High-level details and implementation for patching and ...
- 20.7k
5
votes
Reading Physical Memory
I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault.
Correct. By design, all processes are ...
- 3,002
5
votes
Accepted
Can I set more than 4 memory access breakpoints in WinDbg?
Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
- 4,912
5
votes
Accepted
Do all games have static base addresses for values like gold and energy?
Almost static address can be achieved when the developer use global or static variables.
While this was somewhat popular in the old days, today it is very rare and also considered a bad practice. ...
- 297
5
votes
Accepted
How to reverse engineer a setjmp/longjmp sequence?
I'll start with answering a few basic questions, some of which you didn't even ask!
What are segment registers doing in modern code?
It's been a while since we've needed extra registers to address a ...
- 11.7k
4
votes
How to predict address space layout differences between real and gdb-controlled executions?
Just to add to the answers, I can tell how to get close to a clean environment despite gdb. In fact, there are two methods to reach this:
We can get rid of the extra environment variables added by ...
- 18.9k
4
votes
Accepted
CreateProcess - First thread routine - where is the memory allocated for the thread?
Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary.
How thread creation ...
- 1,234
4
votes
Is it possible ( or how) to dump source code/machine code from memory?
Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost ...
- 2,896
4
votes
Accepted
Is it possible copy and save bootloader using CLI telnet commands?
The bootloader is in the flash, so you have to dump it first by using:
dd if=/dev/mtd0 of=/tmp/mtd0
or
nandump -of /tmp/mtd0 /dev/mtd0
After it you have to copy to an SD card, USB device or send ...
- 1,759
4
votes
Accepted
PE file format: How can I find the heap memory space in a running WinNT program?
Short answer: The heap, stack and other PE loader related tasks are not part of the PE standard or definition.
General Information
the PE file does not describe the entire memory space of an ...
- 11.7k
4
votes
Volatility - manually inspect heap of a process
So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.
...
- 1,257
4
votes
How can I find my variables in the running process?
Your std::string is not a plain ascii string it is a structure (actually a class) so you cannot take the address and find the string.
In your specific case since your string test's length is less ...
- 16.3k
4
votes
Accepted
The C166 family code meaning
Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does.
r5 = r4; // mov r5, r4 - ...
- 166
4
votes
Accepted
Load process from memory dump
What you want exists and is known -- among other terms -- under the term "time travel debugging" (TTD), "replay debugging" and "record and replay debugging". Your ...
- 10.9k
3
votes
How would I go about imaging a propriatary flash or eeprom memory chip?
I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of:
detect/exploit/sniff known interface
Like SPI,JTAG,... or even memory interface (address,...
- 1,384
Only top scored, non community-wiki answers of a minimum length are eligible