Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [memory]

Computer memory refers to a physical device that is used to store sequences of instructions (programs) or data (program state information) on a temporary or permanent basis for use in a computer.

Filter by
Sorted by
Tagged with
1 vote
2 answers
295 views

Data remanence - DDR2

I read "Data Remanence in Semiconductor Devices" by Peter Gutmann, in which it is stated that it is possible to reconstruct the content of an erased SRAM based on changes of properties of ...
0 votes
1 answer
2k views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
3 votes
1 answer
209 views

How to check if a PCI device is trusted or untrusted by the Linux kernel (for IOMMU)?

I am looking into the protection provided by IOMMU against DMA attacks. I noticed that the Linux kernel provides a feature called bounce buffers for untrusted PCI devices (https://lwn.net/Articles/...
0 votes
1 answer
518 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
0 votes
0 answers
75 views

Is it possible to hide a secret value from my own processes on Linux?

I have an application with a shared secret. This application runs as my user. However, Linux has the /proc directory, and particularly /proc/{pid}/mem and /proc/{pid}/maps. Any process created with ...
1 vote
1 answer
270 views

Examining linux memory dump with signs of compromise in yarascan

I have captured a memory dump of recent Ubuntu 22.04 kernel 6.2.0-39-generic. captured image with LiMe and analyzed with volatility3. did a yarascan against all known rules and found a suspicious ...
0 votes
1 answer
1k views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
1 vote
2 answers
328 views

XD/NX Bit in UNIX [Memory Security]

I have been reading about XD/NX bit used in Memory Pages for security. I understand it is a security feature that can help reduce system exposure to viruses and malicious code. If enabled, processor ...
2 votes
2 answers
139 views

Can and should a penetration test report include an informational note about not having used a (by-design) memory-safe programming language?

Firstly, a quote from a good article about the importance of memory safety by memorysafety.org: How common are memory safety vulnerabilities? Extremely. A recent study found that 60-70% of ...
2 votes
2 answers
428 views

How to extract a .bat file with volatility

I am experimenting with the volatility2 tool. I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine. I used the mftparser command as : ...
0 votes
2 answers
275 views

execute command in go without storing the command in a .exe file

I am trying to do a go program to execute a .exe file, but without be actually a .exe file. The idea is to read the executable from a .txt file and decode it (it is in base64). Once I hava that code ...
0 votes
1 answer
321 views

DLL Injection Win32 API

I want to know which Win32 API functions a certain executable calls. The executable is a 32-bit application. I know what steps to take to perform a DLL injection and hook an API function. However, ...
6 votes
1 answer
1k views

Are there any observed Rowhammer attacks in the wild

Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
1 vote
0 answers
80 views

What are the security concerns from failing to unpin memory?

I am trying to understand the implication of CVE-2023-40791. The CVE reads: "Linux kernel before 6.4.12 fails to unpin pages in certain situations". NetApp says this could lead to ...
1 vote
1 answer
143 views

Can malware detect memory dumping?

Morning, I recently had need to check for malware on my PC by dumping the memory and searching for unwanted processes which could be malware, my question it's, is it possibile for malware to detect ...
473 votes
13 answers
109k views

Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's ...
0 votes
0 answers
170 views

Downsides of increased ASLR entropy

ASLR allows to randomize the base address of userspace applications. In Linux, the length of the randomized part of the mmap address can be specified via the kernel build config. It is bound by the ...
4 votes
4 answers
36k views

How to delete a C# variable value permanently from memory?

I have created a variable in C#. Now I want to clear the variables value from the computer memory. Is there any way to do that? Below is my current attempt at deleting the value of recordLine, but I ...
1 vote
3 answers
2k views

Risks of encryption keys contained in a memory dump after a crash?

Assuming a full disk encrypted system where non-volatile storage is encrypted. While the system is running, in case of a crash and memory dump, e.g. plugging a USB drive causing an ...
5 votes
0 answers
213 views

Zeroization of sensitive data in Functional Programming Languages

Concerning the very familiar (and sensible) security practice of Zeroizing sensitive data from memory after you're finished with it, such as Cryptographic keys, passwords, etc, I was pondering how you ...
1 vote
1 answer
107 views

Do frequently crashing programs pose a bigger security threat than stable programs?

If I have an app that's frequently and randomly crashing, will it impose a bigger security threat (e.g: possible attack vector) than apps that are stable? Or are both apps equally protected from such ...
3 votes
1 answer
286 views

accessing ELF in memory (Unix/Linux)

On Linux (and maybe UNIX), you can access and even modify process's stack with things like ptrace, process_vm_ready, etc., but is there a way to access the copy of the binary that's being executed ...
12 votes
6 answers
4k views

Can secrets be made safe in memory?

Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory? So ...
1 vote
0 answers
217 views

How hard is it to modify UEFI nvram if the device is off and the UEFI is locked?

This assumes that: Machine is powered off No UEFI backdoors No Reflashing the firmware No clearing the NVRAM (The point is to modify/read a small amount of NVRAM, instead of resetting it) Device ...
1 vote
1 answer
1k views

How to extract a RSA private key from an ssh-agent core dump

I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python ...
1 vote
0 answers
207 views

How to decrypt SSHv2 using AES-256 session keys from memory dump?

How to decrypt the plaintext contents of an SSH session from a PCAP file and SSHv2 AES session keys from a memory dump. I have the full PCAP for the SSH sessions, including the initial handshake and ...
9 votes
2 answers
5k views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
5 votes
4 answers
11k views

Is this integer overflow vulnerability exploitable?

Is this integer overflow exploitable and if the answer is yes, how can i exploit it? char buffer[20]; int len = atoi(argv[1]); if(len < 20) memcpy(buffer,argv[2],len); If I set len to -1 the ...
1 vote
2 answers
625 views

what is the safest way to open/decrypt an encrypted gpg/pgp file in memory | gnu/linux debian?

I would like to open/decrypt an encrypted gpg/pgp file in the main memory without leaving any footprints on the file system including swap,etc. what is the safest option on a gnu/linux debian from ...
2 votes
1 answer
559 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this with ...
2 votes
1 answer
227 views

Why would garbage collection be a problem in password managers?

I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine) I have not done a thorough code review, ...
7 votes
1 answer
2k views

How can two identical no-PIE binaries run simultaneously?

As I understood it (probably incorrectly) when a no-PIE binary gets loaded into memory it always has the same absolute base address. This doesn't make sense to me. Consider the exact same program ...
1 vote
1 answer
276 views

Cuckoo dump a PE file from a memory dump?

Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process. There is Process-...
6 votes
2 answers
4k views

What is the function of Intel's Total Memory Encryption (TME)?

https://edc.intel.com/content/www/us/en/design/ipla/software-development-platforms/client/platforms/alder-lake-desktop/12th-generation-intel-core-processors-datasheet-volume-1-of-2/002/intel-multi-key-...
0 votes
0 answers
67 views

Could a no code module injected to memory phenomenon in the process tree of the steam.exe file be suspicious?

I found a page, which analyzing memory processes (https://analyze.intezer.com/) After the searches, it didn't find anything harmful, but in the detailed analysis I found a module without code, which ...
0 votes
1 answer
1k views

Is there a way to get Windows login password hint from SAM hive with volatility?

We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
1 vote
0 answers
252 views

How do I go about analysing VirusTotal and Hatching Triage's memdumps?

I normally use volatility to analyse memory dumps, however, in this case it doesn't seem to be working. I get a "Symbol table not found" kind of error, even though I have downloaded and ...
0 votes
1 answer
241 views

Can malware override and execute any memory location or it has to be specific?

Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
-1 votes
1 answer
151 views

Confused about memory examination using gdb

I started reading "Hacking, The Art of Exploitation" and I am confused about some things regarding memory examination. When I disassemble main, I get an output of all memories where the ...
0 votes
0 answers
242 views

sensitive data exposure from RAM memory [duplicate]

I have software written in C# and compiled as a .exe file. How can I read sensitive data (like usernames, passwords, etc.) from RAM while it runs?
5 votes
2 answers
800 views

Turing-completeness impact on system security

I always find in many papers discussing different kind of system security subject that the authors always trying to highlight the danger of some vulnerabilities by assuming an attacker, by exploiting ...
0 votes
1 answer
399 views

Why it's safe to use used RAM?

As we know, instructions are stored in RAM. So, can I embed a controller chip (or something like this) that can change the content of RAM? (e.g. change the Windows 10 boot instructions into malicious ...
2 votes
1 answer
642 views

Does IOMMU protect against malware insertion through PCI Network card/Sound card DMA?

I've just read about this: https://www.tripwire.com/state-of-security/security-data-protection/backdoors-hardware-attacks-rakshasa-malware/ Asides from the question in the title, I'd also like to add ...
29 votes
1 answer
6k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
1 vote
0 answers
425 views

What are the major security differences between jemalloc and mozjemalloc?

In a rather heated mailing list thread, I read some information provided by one of the developers of mozjemalloc, the memory allocator in Firefox that was forked from jemalloc, that stated that the ...
9 votes
1 answer
2k views

How can I protect my home/office computer against row hammer?

Row hammer seems to affect ECC memory less, but ECC is still not immune. I have heard of software mitigations like ANVIL, but that doesn't seem to be 100% row-hammer-proof either. What software or ...
5 votes
1 answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
5 votes
3 answers
3k views

Can someone read a iOS class variable from outside the app?

a class variable like this: @property (strong, nonatomic) NSString *privateValue; Can someone read the value of that variable while it´s in memory? I can´t find anything about this on the apple docs ...
0 votes
0 answers
158 views

Is it possible to inject code using physical memory access to jailbreak phones?

Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
9 votes
1 answer
3k views

Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt)

Using Linux, I have system and swap/hibernation partitions encrypted with LUKS, and data partitions encrypted with Truecrypt, and I am wondering when I put my laptop to hibernation if the encryption ...

1
2 3 4 5
7