Questions tagged [virtual-memory]
In computing, virtual memory is a memory management technique developed for multitasking kernels. This technique virtualizes a computer architecture's various forms of computer data storage (such as random-access memory and disk storage), allowing a program to be designed as though there is only one kind of memory, "virtual" memory, which behaves like directly addressable read/write memory (RAM).
28
questions
1
vote
0
answers
93
views
IAT/IDT in memory PE file
Can anyone please explain me this:
First, we look at the last value of the Optional Header, Data
Directories, the Import Directory RVA value. This value gives us the
address of the Import table when ...
0
votes
1
answer
435
views
How to get information about segments of physical memory not described in System.map on linux
When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64:
00000000000228c0 D softnet_data
0000000000022a80 d ...
- 47
0
votes
1
answer
456
views
Do modern GPUs have memory protection?
What mechanisms (if any) modern GPUs implement to prevent different processes from accessing each other's memory (on graphics card)?
- 101
1
vote
0
answers
230
views
Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR
I'm trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code.
I'm trying to run the attack on my Intel ...
- 111
1
vote
1
answer
1k
views
Writing to .fini_array
I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
1
vote
0
answers
614
views
seDebugPrivilege and OpenProcess() - Trying to understand how Windows restricts access to a process' virtual memory
I’ve been trying to understand how operating systems protect processes from each other. My understanding of Windows security is that a process can call OpenProcess() (thereby allowing read and write ...
- 11
1
vote
2
answers
636
views
Docker container which reads memory belonging to another container
The field of maliciously accessing another process's memory has been broadly studied in the Linux environment.
But for some reason I am not able to find similar discussion/similarities for the ...
- 141
1
vote
2
answers
494
views
Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?
So lets say we have a rootkit on our system
can this rootkit write something inside a kernel process?
for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
- 97
3
votes
1
answer
110
views
Why code memory pages should be readable?
I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x".
But my observation is that the behavior of reading code into ...
- 330
2
votes
1
answer
719
views
Would it be sufficient to perform ASLR by randomizing only the base address of the executable?
According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries.
...
- 421
1
vote
1
answer
289
views
Can you encrypt memory of server which hold luks keys?
I have a cloud VM. It's Centos 7 and I used full disk encryption during install. I also installed dropbear SSH to remotely unlock said server in case of a reboot. No one but me have administrative ...
- 13
10
votes
2
answers
5k
views
Ring 1 and Ring 2 Memory Protection Architecture
I have heard that Ring 1 and Ring 2 memory protections are basically no-longer used within modern systems.
However, when I checked into things, all I found was that these rings are somehow associated ...
- 103
5
votes
1
answer
3k
views
Is the Windows paging file safe in the encrypted partition?
I came across this setting called ClearPageFileAtShutdown. The setting is described here and says:
If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn'...
- 73
29
votes
7
answers
5k
views
Reading physical memory frame previously owned by another process to read contents of its memory page
I had a conversation with @anger32 who states that zeroing a physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
- 912
7
votes
2
answers
26k
views
RAM Encryption. Is it possible? [duplicate]
Without adding any additional hardware, is RAM encryption possible? If so are there any known and currently used implementations for Linux or Windows systems? And if this is something that is possible ...
6
votes
3
answers
2k
views
How to securely read a physical memory address in Linux?
I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
- 69
3
votes
1
answer
451
views
How to detect when your RAM is being copied or scanned by a hypervisor
I am working in a Virtual Machine that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and others could take memory snapshots of my running VM. Is there a way ...
- 133
0
votes
2
answers
872
views
Is it possible to run an encrypted java environment?
I've seen that virtual machines in virtualbox or VMware can be encrypted so that no one on the outside can access the disk, ram or CPU cache since the entire hardware is emulated and encrypted too. I'...
1
vote
0
answers
395
views
Are Hyper-V Memory Snapshots secure/encrypted?
When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the ...
- 222
0
votes
1
answer
2k
views
How safe is virtual box without internet [duplicate]
I am running a windows 7 virtual box without internet connected. Internet is, however, connected to the host, and I allow any internet access to and from the host. On the guest platform I am working ...
1
vote
3
answers
153
views
Completely Protected Virtual Folder
I am a Python / C developer currently working on a extremely important piece of software. The details of the code will not be mentioned, and the only place the code appears is on my own hard drive, in ...
- 11
8
votes
1
answer
7k
views
Does Linux kernel use DEP for kernel memory?
Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
- 99.4k
4
votes
2
answers
675
views
Heartbleed and heap management - Why user data and passwords are kept in memory?
If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
- 2,748
3
votes
2
answers
1k
views
Shutdown: Clear virtual memory pagefile
I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description:
What do it mean by operating system that allow ...
- 4,834
2
votes
3
answers
376
views
PGP on hibernation files?
I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time. It seems to me that PGP and other sensible tools have to lock memory to ...
31
votes
7
answers
23k
views
Why encrypt data in memory?
I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
- 453
3
votes
1
answer
2k
views
Intepreting PE (Portable Executable) headers of suspicious malware files
I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.
Using PEview I am examining the .text, .rdata and .data headers.
I know that if there is a big ...
- 1,550
9
votes
1
answer
4k
views
Effects of DDoS attacks on memory use under Linux
Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
- 321