Collaborate Disseminate
Can anyone please explain me this:
First, we look at the last value of the Optional Header, Data
Directories, the Import Directory RVA value. This value gives us the
address of the Import table when the file is loaded into memory. For
exa… Continue reading IAT/IDT in memory PE file
From here:
I have heard rumors of a grsecurity Wunderwaffe called AUTOSLAB. We don’t know much about it. Presumably, it makes Linux allocate kernel objects in separate slab caches depending on the object type. That could ruin the heap spr… Continue reading What is AUTOSLAB, and how does it work?
When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64:
00000000000228c0 D softnet_data
0000000000022a80 d rt_uncached_list
0000000000022ac0 d rt6_uncac… Continue reading How to get information about segments of physical memory not described in System.map on linux
What mechanisms (if any) modern GPUs implement to prevent different processes from accessing each other’s memory (on graphics card)?
As far as I got we have arena for every thread and if we have too many threads they start sharing arenas using locks to avoid race conditions. For me that sounds pretty fair taking into consideration that we can create up to 8*CPUs arenas … Continue reading Heap question: tcache vs arena per thread
I’m trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code.
I’m trying to run the attack on my Intel Haswell machine, using Linux Ubuntu 20.04, … Continue reading Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR
I’m studying Windows Internals and I don’t understand why/how work the reloc the DLL.
When an app is run, it’s mapped in pagefile (virtual memory) to be translated to physical memory.
So, I understood that the virtual memory has a virtual … Continue reading Reloc the Windows DLLs
Linux is a two-edged sword. On the one hand, there’s so much you can configure. On the other hand, there’s so much you can configure. It is sometimes hard to know just what you should do to get the best performance, especially on a small platform like the Raspberry Pi. …read more
I’m learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and hence redirect execution to the shellcode o… Continue reading Writing to .fini_array
I’ve been trying to understand how operating systems protect processes from each other. My understanding of Windows security is that a process can call OpenProcess() (thereby allowing read and write access to the virtual memo… Continue reading seDebugPrivilege and OpenProcess() – Trying to understand how Windows restricts access to a process’ virtual memory