Questions tagged [virtual-memory]

In computing, virtual memory is a memory management technique developed for multitasking kernels. This technique virtualizes a computer architecture's various forms of computer data storage (such as random-access memory and disk storage), allowing a program to be designed as though there is only one kind of memory, "virtual" memory, which behaves like directly addressable read/write memory (RAM).

Filter by
Sorted by
Tagged with
1
vote
0answers
48 views

Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR

I'm trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code. I'm trying to run the attack on my Intel ...
1
vote
1answer
154 views

Writing to .fini_array

I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
1
vote
0answers
233 views

seDebugPrivilege and OpenProcess() - Trying to understand how Windows restricts access to a process' virtual memory

I’ve been trying to understand how operating systems protect processes from each other. My understanding of Windows security is that a process can call OpenProcess() (thereby allowing read and write ...
0
votes
2answers
177 views

Docker container which reads memory belonging to another container

The field of maliciously accessing another process's memory has been broadly studied in the Linux environment. But for some reason I am not able to find similar discussion/similarities for the ...
1
vote
2answers
215 views

Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

So lets say we have a rootkit on our system can this rootkit write something inside a kernel process? for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
3
votes
1answer
62 views

Why code memory pages should be readable?

I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x". But my observation is that the behavior of reading code into ...
2
votes
1answer
476 views

Would it be sufficient to perform ASLR by randomizing only the base address of the executable?

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. ...
1
vote
1answer
220 views

Can you encrypt memory of server which hold luks keys?

I have a cloud VM. It's Centos 7 and I used full disk encryption during install. I also installed dropbear SSH to remotely unlock said server in case of a reboot. No one but me have administrative ...
7
votes
2answers
3k views

Ring 1 and Ring 2 Memory Protection Architecture

I have heard that Ring 1 and Ring 2 memory protections are basically no-longer used within modern systems. However, when I checked into things, all I found was that these rings are somehow associated ...
5
votes
1answer
2k views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn'...
27
votes
7answers
4k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing a physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
5
votes
2answers
16k views

RAM Encryption. Is it possible? [duplicate]

Without adding any additional hardware, is RAM encryption possible? If so are there any known and currently used implementations for Linux or Windows systems? And if this is something that is possible ...
6
votes
3answers
2k views

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
3
votes
1answer
354 views

How to detect when your RAM is being copied or scanned by a hypervisor

I am working in a Virtual Machine that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and others could take memory snapshots of my running VM. Is there a way ...
0
votes
2answers
674 views

Is it possible to run an encrypted java environment?

I've seen that virtual machines in virtualbox or VMware can be encrypted so that no one on the outside can access the disk, ram or CPU cache since the entire hardware is emulated and encrypted too. I'...
1
vote
0answers
276 views

Are Hyper-V Memory Snapshots secure/encrypted?

When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the ...
0
votes
1answer
1k views

How safe is virtual box without internet [duplicate]

I am running a windows 7 virtual box without internet connected. Internet is, however, connected to the host, and I allow any internet access to and from the host. On the guest platform I am working ...
1
vote
3answers
107 views

Completely Protected Virtual Folder

I am a Python / C developer currently working on a extremely important piece of software. The details of the code will not be mentioned, and the only place the code appears is on my own hard drive, in ...
8
votes
1answer
4k views

Does Linux kernel use DEP for kernel memory?

Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
4
votes
2answers
575 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
3
votes
2answers
1k views

Shutdown: Clear virtual memory pagefile

I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description: What do it mean by operating system that allow ...
2
votes
3answers
316 views

PGP on hibernation files?

I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time. It seems to me that PGP and other sensible tools have to lock memory to ...
28
votes
7answers
18k views

Why encrypt data in memory?

I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
2
votes
1answer
1k views

Intepreting PE (Portable Executable) headers of suspicious malware files

I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated. Using PEview I am examining the .text, .rdata and .data headers. I know that if there is a big ...
9
votes
1answer
3k views

Effects of DDoS attacks on memory use under Linux

Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...