9
votes
Why does PE ImageBase address change in memory?
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into ...
- 4,952
7
votes
Accepted
What is this hidden stack used by syscalls on Windows?
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
- 682
2
votes
Accepted
RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz
vmlinuz.lz contains the kernel image.
$ binwalk vmlinux.lz
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
12 ...
- 7,236
2
votes
Accepted
How to find "RawAddress" of a "VirtualAddress"?
you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the ...
- 36.9k
1
vote
Accepted
WinDbg command to retrieve TTBR registers for Aarch64?
UPDATE 2: short answer is rdmsr 0x00030200. The harder question is how to determine the "MSR" values? this is done by using ARM64_WINDBG_SYSREG macro which is defined as follows:
#define ...
- 408
1
vote
Accepted
How are processes assigned a virtual base address
I believe what makes the difference is ASLR - Adress Space Layout Randomization - Read about it here - so basically it's just a layer of security protection.
It's indeed possible to load two different ...
- 1,858
1
vote
Accepted
How to protect memory area, not segment or page!
The protections are supported only on page granularity by the CPU and you cannot change that. What you can do is in your exception handler check which address generated the fault, and if it's not the ...
- 36.9k
1
vote
Accepted
Can a Data Type Span Multiple Virtual Pages? (Windows)
I don't see why not.
For instance, if I'm mapping a binary file into memory, I may configure its structure as such:
//Visual Studio code
#pragma pack(push,1)
struct STRUCT1{
char dummy[0x1000 - ...
- 1,761
1
vote
Can a Data Type Span Multiple Virtual Pages? (Windows)
While it can happen as a result of hand-coded code, it is unlikely in practice to occur as a result of compiled code. Compilers generally align data appropriately such that a 4-bytes value will begin ...
- 4,709
Only top scored, non community-wiki answers of a minimum length are eligible