New answers tagged memory
0
You understanding is correct:
PE's IAT is resolved by the system loader and can be made read-only afterwards.
ELF's GOT entries initially point to PLT stubs and are overwritten with the final address on the first call.. meaning GOT needs to remain writable.
Writable GOT is indeed a known source of vulnerabilities which is why mitigations like RELRO have ...
1
Procedure:
Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab.
Find the binary name in info column. Then copy the address with the right
click on it. For example, in the following screenshot, the x86_64 PE binary
name is Project1.exe and the base address is 0x00007FF6A4850000.
Rebase in IDA: Open the binary in IDA. Click on Edit >...
2
The block selection logic just looks at the 4 most significant bits of the address, this is easily implemented by a multiplexer whose outputs feed into the enable pin of each memory chip. An 3 bit multiplexer and an OR gate (if active high) is enough to implement this scheme.
The mirroring within a block happens by not connecting the next set of significant ...
0
Relocations are processed by the loader, just like imports and everything else in the PE header is. All of this is processed before executing the entry point. Typically speaking relocations will be initially set to the VA (virtual address) of the target using preferred image base address. Of course in many cases the binary will not be loaded at the base ...
1
Sections are always mapped to the same location relative to each other (the section table in the file describes the layout, via the VirtualAddress field). Only the starting address for the entire module can change. The relocation table is generally(*) used to update absolute values according to the difference between the starting address that was specified ...
Top 50 recent answers are included
