Questions tagged [virtual-memory]

In computing, virtual memory is a memory management technique developed for multitasking kernels. This technique virtualizes a computer architecture's various forms of computer data storage (such as random-access memory and disk storage), allowing a program to be designed as though there is only one kind of memory, "virtual" memory, which behaves like directly addressable read/write memory (RAM).

Filter by
Sorted by
Tagged with
1 vote
0 answers

IAT/IDT in memory PE file

Can anyone please explain me this: First, we look at the last value of the Optional Header, Data Directories, the Import Directory RVA value. This value gives us the address of the Import table when ...
Pieter Jansen's user avatar
0 votes
1 answer

How to get information about segments of physical memory not described in on linux

When I do in linux root shell cat /boot/$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64: 00000000000228c0 D softnet_data 0000000000022a80 d ...
nusch's user avatar
  • 47
0 votes
1 answer

Do modern GPUs have memory protection?

What mechanisms (if any) modern GPUs implement to prevent different processes from accessing each other's memory (on graphics card)?
zduny's user avatar
  • 101
1 vote
0 answers

Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR

I'm trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code. I'm trying to run the attack on my Intel ...
parisa's user avatar
  • 111
1 vote
1 answer

Writing to .fini_array

I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
Atticus Stonestrom's user avatar
1 vote
0 answers

seDebugPrivilege and OpenProcess() - Trying to understand how Windows restricts access to a process' virtual memory

I’ve been trying to understand how operating systems protect processes from each other. My understanding of Windows security is that a process can call OpenProcess() (thereby allowing read and write ...
Ted's user avatar
  • 11
1 vote
2 answers

Docker container which reads memory belonging to another container

The field of maliciously accessing another process's memory has been broadly studied in the Linux environment. But for some reason I am not able to find similar discussion/similarities for the ...
Anton.P's user avatar
  • 141
1 vote
2 answers

Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

So lets say we have a rootkit on our system can this rootkit write something inside a kernel process? for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
Max's user avatar
  • 97
3 votes
1 answer

Why code memory pages should be readable?

I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x". But my observation is that the behavior of reading code into ...
Infinite's user avatar
  • 330
2 votes
1 answer

Would it be sufficient to perform ASLR by randomizing only the base address of the executable?

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. ...
user1118764's user avatar
1 vote
1 answer

Can you encrypt memory of server which hold luks keys?

I have a cloud VM. It's Centos 7 and I used full disk encryption during install. I also installed dropbear SSH to remotely unlock said server in case of a reboot. No one but me have administrative ...
deleteme's user avatar
10 votes
2 answers

Ring 1 and Ring 2 Memory Protection Architecture

I have heard that Ring 1 and Ring 2 memory protections are basically no-longer used within modern systems. However, when I checked into things, all I found was that these rings are somehow associated ...
Guy Incognito's user avatar
5 votes
1 answer

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn'...
Iteration's user avatar
29 votes
7 answers

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing a physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
KOLANICH's user avatar
  • 912
7 votes
2 answers

RAM Encryption. Is it possible? [duplicate]

Without adding any additional hardware, is RAM encryption possible? If so are there any known and currently used implementations for Linux or Windows systems? And if this is something that is possible ...
16b7195abb140a3929bbc322d1c6f1's user avatar
6 votes
3 answers

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
Vasu's user avatar
  • 69
3 votes
1 answer

How to detect when your RAM is being copied or scanned by a hypervisor

I am working in a Virtual Machine that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and others could take memory snapshots of my running VM. Is there a way ...
user3779430's user avatar
0 votes
2 answers

Is it possible to run an encrypted java environment?

I've seen that virtual machines in virtualbox or VMware can be encrypted so that no one on the outside can access the disk, ram or CPU cache since the entire hardware is emulated and encrypted too. I'...
user1768940's user avatar
1 vote
0 answers

Are Hyper-V Memory Snapshots secure/encrypted?

When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the ...
Jey DWork's user avatar
  • 222
0 votes
1 answer

How safe is virtual box without internet [duplicate]

I am running a windows 7 virtual box without internet connected. Internet is, however, connected to the host, and I allow any internet access to and from the host. On the guest platform I am working ...
clairebeach's user avatar
1 vote
3 answers

Completely Protected Virtual Folder

I am a Python / C developer currently working on a extremely important piece of software. The details of the code will not be mentioned, and the only place the code appears is on my own hard drive, in ...
joebloggs's user avatar
8 votes
1 answer

Does Linux kernel use DEP for kernel memory?

Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
D.W.'s user avatar
  • 99.4k
4 votes
2 answers

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
ack__'s user avatar
  • 2,748
3 votes
2 answers

Shutdown: Clear virtual memory pagefile

I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description: What do it mean by operating system that allow ...
Ali Ahmad's user avatar
  • 4,834
2 votes
3 answers

PGP on hibernation files?

I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time. It seems to me that PGP and other sensible tools have to lock memory to ...
F. Hauri  - Give Up GitHub's user avatar
31 votes
7 answers

Why encrypt data in memory?

I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
user573215's user avatar
3 votes
1 answer

Intepreting PE (Portable Executable) headers of suspicious malware files

I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated. Using PEview I am examining the .text, .rdata and .data headers. I know that if there is a big ...
Franko's user avatar
  • 1,550
9 votes
1 answer

Effects of DDoS attacks on memory use under Linux

Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
nlovric's user avatar
  • 321