9 votes

Why does PE ImageBase address change in memory?

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...
7 votes
Accepted

What is this hidden stack used by syscalls on Windows?

This doesn't happen during the system call. It happens in user-mode. WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
  • 632
3 votes
Accepted

/proc/self/maps equivalent on windows

VirtualQueryEx() fills a MEMORY_BASIC_INFORMATION record with information about a contiguous range of pages containing the queried address. This can be used to walk the address space of a process, by ...
  • 1,970
2 votes
Accepted

RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz

vmlinuz.lz contains the kernel image. $ binwalk vmlinux.lz DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 12 ...
  • 6,929
2 votes
Accepted

How to find "RawAddress" of a "VirtualAddress"?

you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the ...
  • 35.3k
1 vote
Accepted

How are processes assigned a virtual base address

I believe what makes the difference is ASLR - Adress Space Layout Randomization - Read about it here - so basically it's just a layer of security protection. It's indeed possible to load two different ...
1 vote

Reading the process memory yields different results

OllyDbg shows memory regions of all types, whereas your code doesn't show MEM_IMAGE regions. Replace if ((info.State == MEM_COMMIT) && ((info.Type & MEM_MAPPED) || (info.Type & ...
1 vote
Accepted

How to protect memory area, not segment or page!

The protections are supported only on page granularity by the CPU and you cannot change that. What you can do is in your exception handler check which address generated the fault, and if it's not the ...
  • 35.3k
1 vote
Accepted

Can a Data Type Span Multiple Virtual Pages? (Windows)

I don't see why not. For instance, if I'm mapping a binary file into memory, I may configure its structure as such: //Visual Studio code #pragma pack(push,1) struct STRUCT1{ char dummy[0x1000 - ...
  • 1,357
1 vote

Can a Data Type Span Multiple Virtual Pages? (Windows)

While it can happen as a result of hand-coded code, it is unlikely in practice to occur as a result of compiled code. Compilers generally align data appropriately such that a 4-bytes value will begin ...
  • 4,521

Only top scored, non community-wiki answers of a minimum length are eligible