Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [memory]

Computer memory refers to a physical device that is used to store sequences of instructions (programs) or data (program state information) on a temporary or permanent basis for use in a computer.

Filter by
Sorted by
Tagged with
0 votes
0 answers
75 views

Is it possible to hide a secret value from my own processes on Linux?

I have an application with a shared secret. This application runs as my user. However, Linux has the /proc directory, and particularly /proc/{pid}/mem and /proc/{pid}/maps. Any process created with ...
Cort Ammon's user avatar
  • 9,248
2 votes
2 answers
139 views

Can and should a penetration test report include an informational note about not having used a (by-design) memory-safe programming language?

Firstly, a quote from a good article about the importance of memory safety by memorysafety.org: How common are memory safety vulnerabilities? Extremely. A recent study found that 60-70% of ...
Bob Ortiz's user avatar
  • 6,665
1 vote
0 answers
80 views

What are the security concerns from failing to unpin memory?

I am trying to understand the implication of CVE-2023-40791. The CVE reads: "Linux kernel before 6.4.12 fails to unpin pages in certain situations". NetApp says this could lead to ...
Munazh's user avatar
  • 11
1 vote
1 answer
270 views

Examining linux memory dump with signs of compromise in yarascan

I have captured a memory dump of recent Ubuntu 22.04 kernel 6.2.0-39-generic. captured image with LiMe and analyzed with volatility3. did a yarascan against all known rules and found a suspicious ...
Zzgooloo's user avatar
1 vote
1 answer
143 views

Can malware detect memory dumping?

Morning, I recently had need to check for malware on my PC by dumping the memory and searching for unwanted processes which could be malware, my question it's, is it possibile for malware to detect ...
Hopkins's user avatar
  • 13
0 votes
0 answers
170 views

Downsides of increased ASLR entropy

ASLR allows to randomize the base address of userspace applications. In Linux, the length of the randomized part of the mmap address can be specified via the kernel build config. It is bound by the ...
user5626466's user avatar
0 votes
2 answers
276 views

execute command in go without storing the command in a .exe file

I am trying to do a go program to execute a .exe file, but without be actually a .exe file. The idea is to read the executable from a .txt file and decode it (it is in base64). Once I hava that code ...
P00's user avatar
  • 1
1 vote
1 answer
107 views

Do frequently crashing programs pose a bigger security threat than stable programs?

If I have an app that's frequently and randomly crashing, will it impose a bigger security threat (e.g: possible attack vector) than apps that are stable? Or are both apps equally protected from such ...
AvidSeeker's user avatar
3 votes
1 answer
209 views

How to check if a PCI device is trusted or untrusted by the Linux kernel (for IOMMU)?

I am looking into the protection provided by IOMMU against DMA attacks. I noticed that the Linux kernel provides a feature called bounce buffers for untrusted PCI devices (https://lwn.net/Articles/...
sammy17's user avatar
  • 31
3 votes
1 answer
286 views

accessing ELF in memory (Unix/Linux)

On Linux (and maybe UNIX), you can access and even modify process's stack with things like ptrace, process_vm_ready, etc., but is there a way to access the copy of the binary that's being executed ...
R-Rothrock's user avatar
0 votes
1 answer
321 views

DLL Injection Win32 API

I want to know which Win32 API functions a certain executable calls. The executable is a 32-bit application. I know what steps to take to perform a DLL injection and hook an API function. However, ...
Pieter Jansen's user avatar
1 vote
0 answers
207 views

How to decrypt SSHv2 using AES-256 session keys from memory dump?

How to decrypt the plaintext contents of an SSH session from a PCAP file and SSHv2 AES session keys from a memory dump. I have the full PCAP for the SSH sessions, including the initial handshake and ...
Wesley Jones's user avatar
2 votes
2 answers
428 views

How to extract a .bat file with volatility

I am experimenting with the volatility2 tool. I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine. I used the mftparser command as : ...
bd55's user avatar
  • 23
1 vote
2 answers
625 views

what is the safest way to open/decrypt an encrypted gpg/pgp file in memory | gnu/linux debian?

I would like to open/decrypt an encrypted gpg/pgp file in the main memory without leaving any footprints on the file system including swap,etc. what is the safest option on a gnu/linux debian from ...
Z0OM's user avatar
  • 119
2 votes
1 answer
227 views

Why would garbage collection be a problem in password managers?

I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine) I have not done a thorough code review, ...
Machavity's user avatar
  • 3,798
7 votes
1 answer
2k views

How can two identical no-PIE binaries run simultaneously?

As I understood it (probably incorrectly) when a no-PIE binary gets loaded into memory it always has the same absolute base address. This doesn't make sense to me. Consider the exact same program ...
Alexander Haas's user avatar
1 vote
1 answer
276 views

Cuckoo dump a PE file from a memory dump?

Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process. There is Process-...
0xh3xa's user avatar
  • 113
1 vote
2 answers
295 views

Data remanence - DDR2

I read "Data Remanence in Semiconductor Devices" by Peter Gutmann, in which it is stated that it is possible to reconstruct the content of an erased SRAM based on changes of properties of ...
Hasbo's user avatar
  • 9
0 votes
0 answers
67 views

Could a no code module injected to memory phenomenon in the process tree of the steam.exe file be suspicious?

I found a page, which analyzing memory processes (https://analyze.intezer.com/) After the searches, it didn't find anything harmful, but in the detailed analysis I found a module without code, which ...
user avatar
6 votes
2 answers
4k views

What is the function of Intel's Total Memory Encryption (TME)?

https://edc.intel.com/content/www/us/en/design/ipla/software-development-platforms/client/platforms/alder-lake-desktop/12th-generation-intel-core-processors-datasheet-volume-1-of-2/002/intel-multi-key-...
Grant Curell's user avatar
1 vote
0 answers
253 views

How do I go about analysing VirusTotal and Hatching Triage's memdumps?

I normally use volatility to analyse memory dumps, however, in this case it doesn't seem to be working. I get a "Symbol table not found" kind of error, even though I have downloaded and ...
CBot's user avatar
  • 33
0 votes
1 answer
1k views

Is there a way to get Windows login password hint from SAM hive with volatility?

We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
bd55's user avatar
  • 23
0 votes
1 answer
241 views

Can malware override and execute any memory location or it has to be specific?

Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
Sir Muffington's user avatar
1 vote
1 answer
1k views

How to extract a RSA private key from an ssh-agent core dump

I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python ...
Wesley Jones's user avatar
-1 votes
1 answer
151 views

Confused about memory examination using gdb

I started reading "Hacking, The Art of Exploitation" and I am confused about some things regarding memory examination. When I disassemble main, I get an output of all memories where the ...
jprossv's user avatar
0 votes
0 answers
242 views

sensitive data exposure from RAM memory [duplicate]

I have software written in C# and compiled as a .exe file. How can I read sensitive data (like usernames, passwords, etc.) from RAM while it runs?
p.soheyli's user avatar
1 vote
0 answers
217 views

How hard is it to modify UEFI nvram if the device is off and the UEFI is locked?

This assumes that: Machine is powered off No UEFI backdoors No Reflashing the firmware No clearing the NVRAM (The point is to modify/read a small amount of NVRAM, instead of resetting it) Device ...
A-random-nerd's user avatar
0 votes
1 answer
399 views

Why it's safe to use used RAM?

As we know, instructions are stored in RAM. So, can I embed a controller chip (or something like this) that can change the content of RAM? (e.g. change the Windows 10 boot instructions into malicious ...
Hanbi's user avatar
  • 21
1 vote
2 answers
328 views

XD/NX Bit in UNIX [Memory Security]

I have been reading about XD/NX bit used in Memory Pages for security. I understand it is a security feature that can help reduce system exposure to viruses and malicious code. If enabled, processor ...
Aishwarya's user avatar
0 votes
0 answers
158 views

Is it possible to inject code using physical memory access to jailbreak phones?

Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
userdatagram's user avatar
1 vote
0 answers
174 views

Cold boot attack on NAS

I'm familiar with the concept of cold boot attacks on laptop and desktop computers, where the goal is to find hidden encryption keys in the memory. I also think it's done on certain mobile phones. I ...
laddmeister's user avatar
1 vote
0 answers
388 views

C - Remote string format attack exploit - %n Does not seem to write anything on the stack

[As part of a ctf] I am trying to exploit a remote server through a tcp connection. The server is using snprintf() and provides user input as the formatting string. My goal is to dump the stack. ...
Desperados's user avatar
0 votes
1 answer
110 views

What does leak in memory/info leaks?

When a binary is running and there is some memory/info leak are there areas of program (or OS?) memory which are more prone to leak and is a leak in one segment worse than in another segment?
larsmitsars's user avatar
2 votes
1 answer
748 views

Finding Officejet 8600's bulit-in RAM

Before I give away my dead HP Officejet 8600 Pro for recycling, I want to ensure that no memory remains on it. Even after extensive research, it's not easy to find conclusive information on whether a ...
Enwater's user avatar
  • 23
3 votes
1 answer
232 views

Child processes vs microservices for communication between components

This is a question for operating system security experts. We have an application using one platform/language, and it has to integrate with a library that uses another platform/language. There is no ...
fernacolo's user avatar
  • 254
0 votes
0 answers
339 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
Greg Gregson's user avatar
2 votes
1 answer
619 views

Memory encryption against memory leaks

Will memory encryption (or compression) provided by Intel or AMD processors protect against attacks like HeartBleed or similar memory leaks?
ScreechingMultimeterNoises's user avatar
0 votes
0 answers
146 views

"Intercepting" executable with FTK Imager

I want to analyze the traces of a program in my VM by executing it and then capturing the memory and disk using FTK Imager. However, it looks like --given the environment I have-- the program only ...
Néstor Llop's user avatar
3 votes
1 answer
634 views

Does Intel's vPro TME make a locked screen more secure?

This post seems on point but I didn't understand the answer enough to answer this question. Intel's vPro offers "Total Memory Encryption" (TME), which encrypts RAM and system bus data while ...
user847's user avatar
  • 31
-1 votes
1 answer
248 views

code and memory safety issues

I'm preparing for a computer security exam, and I found this question in previous exams To create an authentication program, we write a check_auth function as follows: int check_auth(char *password) {...
Bella's user avatar
  • 3
0 votes
1 answer
470 views

Buffer overread

I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
Mohammed Abdu's user avatar
2 votes
1 answer
284 views

What does Snowden mean by "majority of vulnerabilities ... are introduced, for technical reasons ..., at the exact time the code is written"?

In a recent Substack article ("The Insecurity Industry", 2021-07-26) Edward Snowden writes: The vast majority of vulnerabilities that are later discovered and exploited by the Insecurity ...
Arminius's user avatar
  • 44.8k
1 vote
2 answers
856 views

Create memory image of infected machine without risk

I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics. The problem is that the machine does not have the tools for ...
Rémy Legrand's user avatar
3 votes
0 answers
239 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
chephato's user avatar
0 votes
1 answer
223 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
antmar904's user avatar
0 votes
0 answers
114 views

How useful are memory forensic tools for detecting active attacks (considering current devices)

Are memory forensic tools useful for attack detection? Usually they are applied after an attack has happened. You could always constantly scan a machine but this requires lots of resources and ...
SauceAsAService's user avatar
1 vote
1 answer
3k views

Disable memory scrambling [closed]

Is it possible to disable memory scrambling for RAM? Can you change what kind of algorithm is used? Can you check from inside the OS which is using the memory if/what scrambling is in use? Do devices ...
SauceAsAService's user avatar
1 vote
1 answer
498 views

How do memory resident viruses work?

Two part question: 1-How do memory resident viruses stay in memory after the program which loaded them is finalized? If all memory is automatically deallocated by the OS once a program is finished, ...
galmeida's user avatar
  • 113
0 votes
3 answers
247 views

How to donate a computer without jeopardizing personal information?

I have an old computer that is no longer working and I want to donate it or perhaps throw it in the trash. However, I don't want people to potentially get my banking account data, usernames/passwords ...
user avatar
9 votes
2 answers
5k views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
Luc's user avatar
  • 32.9k

1
2 3 4 5
7