Process Memory Basics for Reverse Engineers Module 3 - Memory Protections
Added 2022-10-16 02:05:53 +0000 UTCThis is the third and final part in our three-part series on process memory with a focus on tracking memory with a debugger. In this tutorial we look at process memory protections and specifically how the PAGE_GUARD works, and what a memory "breakpoint" is in x64dbg.
Further Reading
- X64dbg (hopefully you already have this installed)
- X64dbg command line reference
- Memory Protection Constants
- DEP
- NtProtectVirtualMemory
- VirtualProtect
- Creating Guard Pages
Hands-On Example
Attached to this post is the compiled example we analyzed in the tutorial. You are encouraged to analyze the binary with x64dbg. See if you can use a memory breakpoint to halt execution before the shell code is run.
Comments
Very nice series
2ourc3
2024-04-05 15:20:25 +0000 UTC
