Hot answers tagged

15 votes
Accepted

How does a SIM card work?

SIMs card are a type of Universal Integrated Circuit Card (UICC). how exactly do they work According to Karsten Nohl's presentation "Mobile Network Attack Evolution", SIM cards contain an embedded ...
user avatar
  • 6,829
13 votes

How does glibc malloc work?

For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented: ...
user avatar
  • 6,829
12 votes
Accepted

Where is ntdll.dll?

The code below will set EAX to the image base address of ntdll.dll: MOV EAX, DWORD PTR FS:[30] ; EAX = PEB MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX =...
user avatar
11 votes

\??\C:\ Question Marks in Paths

I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here. ...
user avatar
11 votes

What causes the need for NOP sleds?

On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
user avatar
  • 6,829
9 votes

Reverse engineering Perl-compatible regular-expressions

Googling for 0x50435245 gives several hits, for example here: /* Magic number to provide a small check against being handed junk. Also used to detect whether a pattern was compiled on a host of ...
user avatar
  • 34.6k
9 votes
Accepted

How to retrieve assembly from a raw memory dump?

Disassembling You can disassemble in WinDbg at any memory address, e.g. 0:067> db 000007fe`ff4d0000 000007fe`ff4d0000 4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ.............. 000007fe`...
user avatar
9 votes
Accepted

Do all drivers exist in Kernel mode?

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver ...
user avatar
9 votes

How does glibc malloc work?

There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow. You can look at the ...
user avatar
  • 18k
8 votes

How does new operator internally work in C++?

This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
user avatar
  • 34.6k
7 votes
Accepted

How does Ollydbg obtain the memory map (alt+m)?

VirtualQueryEx() can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory ...
user avatar
7 votes
Accepted

What's a good method to find the location of objects in a game

I'll make the assumption that the application is written in Visual C++. CheatEngine itself is already pretty useful for finding your objects - first you need to find the place in code where these ...
user avatar
7 votes
Accepted

Are vTable pointers always located inside a module?

Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
user avatar
7 votes

How to set a breakpoint on a 64 bit process button with x64dbg?

Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them. After running the exe, go to Handles tab > ...
user avatar
7 votes
Accepted

What is this hidden stack used by syscalls on Windows?

This doesn't happen during the system call. It happens in user-mode. WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
user avatar
  • 632
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
user avatar
6 votes
Accepted

How can I make IDA start the analysis at imagebase?

PE executables start with a header block that consists of a little DOS exe stub (with its own little header), a structure called IMAGE_NT_HEADERS, and a section table. A normal PE has no 32-bit/64-bit ...
user avatar
  • 1,940
6 votes
Accepted

Dealing with instructions that are accessed by multiple pieces of data

The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic ...
user avatar
  • 2,144
6 votes
Accepted

Why there are only 8 hexa memory digits while my RAM is 16G

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory ...
user avatar
5 votes

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

Because the operating system is initializing ESP always at the same value (and that the execution of the program you look at are deterministic). The way the ASLR (Address-Space Layout Randomization) ...
user avatar
  • 18k
5 votes

Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?

This is a continuation of non-return based gadgets. A ROP-gadget in itself is a segment of code that you can use to manipulate data, and get some desired effect, while maintaining control of ...
user avatar
  • 496
5 votes
Accepted

0x09-0x0d not taken into account with scanf

The scanf function skips over leading whitespace, with whitespace being the set of characters for which the isspace macro/function returns true. In the standard locale, this set of characters ...
user avatar
5 votes

How to identify code ran when clicking on an object in a game

On windows you can find winproc function, search click messages within it and add breakpoint/trace from there... On different OS trace mouse handlers ... If OpenGL is used The Object selection is ...
user avatar
  • 1,374
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
user avatar
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
user avatar
5 votes
Accepted

Master of Orion and scanmem

This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
user avatar
5 votes

Reading Physical Memory

I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault. Correct. By design, all processes are ...
user avatar
  • 2,832
5 votes
Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
user avatar
5 votes
Accepted

How to reverse engineer a setjmp/longjmp sequence?

I'll start with answering a few basic questions, some of which you didn't even ask! What are segment registers doing in modern code? It's been a while since we've needed extra registers to address a ...
user avatar
  • 11.3k
4 votes

Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?

Yes, all the opcodes ending by a ret can be considered as a gadget. But, consider also the fact that not only legal instructions can be considered as gadget, also 'starting in the middle of an ...
user avatar
  • 18k

Only top scored, non community-wiki answers of a minimum length are eligible