Process Memory Basics for Reverse Engineers Module 1 - Watching Memory Allocations With a Debugger
Added 2022-09-25 16:13:56 +0000 UTCThis is the first in a short three-part series on memory allocation with a focus on tracking memory with a debugger. In this tutorial we look at the basics, how is memory allocated, and how to follow memory allocations with x64dbg.
Further Reading
- X64dbg (hopefully you already have this installed)
- X64dbg command line reference
- NtAllocateVirtualMemory Documentation
- Allocating 32-bit memory on 64-bit systems (Stack Overflow)
- PEB Documentation
Hands-On Example
Attached to this post is the compiled example we analyzed in the tutorial. You are encouraged to analyze the binary with x64dbg. See if you can watch all of the memory allocations with a breakpoint on NtAllocateVirtualMemory.
Comments
My apologies, I originally uploaded the wrong example (I mixed up module 1, and 2). If you tried the exercise and it didn't make much sense that is why. It is fixed now, sorry for the mixup.
OALABS
2022-11-03 19:21:16 +0000 UTC
