The Cache: Technology Expert's Forum
 
*
Welcome, Guest. Please login or register. July 03, 2009, 04:08:22 PM

Login with username, password and session length


Pages: [1]
  Print  
Author Topic: Windows Memory Swindle & OS-X 64bit direction  (Read 1133 times)
perkiset
Olde World Hacker
Administrator
Lifer
*****
Online Online

Posts: 6011



View Profile
« on: September 03, 2008, 09:35:44 AM »

I'd love to hear from anyone on the Windoz side of the fence regarding this issue:

http://www.appleinsider.com/articles/08/09/03/road_to_mac_os_x_snow_leopard_64_bits_santa_rosa_and_the_great_pc_swindle.html

because it would appear that they are hiding something really important, but I don't know anywhere near enough about low level stuff anymore to decipher if this is propaganda or f'reals
Logged

Don't make me... Get off my lawn.
nutballs
Administrator
Lifer
*****
Online Online

Posts: 3990


View Profile
« Reply #1 on: September 03, 2008, 09:51:21 AM »

i just read it. now i am dumber. I have no idea what the hell i just read.
Logged
vsloathe
vim ftw!
Global Moderator
Lifer
*****
Online Online

Posts: 1049



View Profile
« Reply #2 on: September 03, 2008, 10:02:49 AM »

Dunno man. My OSes are transparent, and I've been doing strictly 64-bit for a while now.
Logged

perkiset
Olde World Hacker
Administrator
Lifer
*****
Online Online

Posts: 6011



View Profile
« Reply #3 on: September 03, 2008, 11:18:56 AM »

i just read it. now i am dumber. I have no idea what the hell i just read.

ROFLMAO
Logged

Don't make me... Get off my lawn.
emonk
Rookie
**
Offline Offline

Posts: 44


View Profile
« Reply #4 on: September 04, 2008, 12:00:48 PM »

I'd love to hear from anyone on the Windoz side of the fence regarding this issue:

http://www.appleinsider.com/articles/08/09/03/road_to_mac_os_x_snow_leopard_64_bits_santa_rosa_and_the_great_pc_swindle.html

because it would appear that they are hiding something really important, but I don't know anywhere near enough about low level stuff anymore to decipher if this is propaganda or f'reals

 Yes, it's true. 64bit windows is pointless as the drivers don't exist,  and applications are closed source binaries that aren't compiled to be 64 bit aware. Using more than 4 gig of ram under windows is damned near impossible and expensive to boot.

 Windows is a toy operating system for grandmothers and 'hobbyists'. Always has been, and always will be.

 
Logged
perkiset
Olde World Hacker
Administrator
Lifer
*****
Online Online

Posts: 6011



View Profile
« Reply #5 on: September 04, 2008, 12:21:54 PM »

Windows is a toy operating system for grandmothers and 'hobbyists'. Always has been, and always will be.

I knew I liked you for some reason Wink
Logged

Don't make me... Get off my lawn.
nop_90
Global Moderator
Lifer
*****
Offline Offline

Posts: 1225


View Profile
« Reply #6 on: September 13, 2008, 02:14:21 PM »

For historical purposes memory in x86 machines are addressed by segments
As in u have a segment register and then the actual register to into the offset
A 32 bit register can only address approx 4G memory.
But to address more then 4G memory the segment register (which is 16 bits wide) can be set to what base to use.
And again it depends on how the OS chooses to use the segment registers to address memory (and i have no idea).

To make shit more confusing all the memory is "virtual".
So from a virtual to "real memory" it achieves this by paging. So under any modern os, ur memory is never continuous it just appears that way.

What they author is claiming is that no windows app can address more then 4G memory - the memory mapped video driver memory etc.
That means that while they can execute 64-bit code and handle 64-bit virtual memory, they still can't address more than 4GB of physical RAM, minus roughly 0.75 GB of MMIO, for a grant total of 3.2GB usable RAM. If you install a full 4GB, the portion in conflict with the MMIO will simply not be used. For PC users installing a high end video card with 1GB of VRAM, the additional MMIO becomes an even greater problem: their usable system RAM shrinks by down to around 2.3GB.

I have not poked arround in internals of windows for long time, and in the past that was true.
(Again it can be fixed by how the segment registers address).

But again he is confusing virtual memory with physical memory.
So no application can use more the 4G memory, but on the big picture when it maps from virtual to physical having more physical memory will be benifitial regardless.
But having all the MMIO mapped to the same address space in each program could be more efficient.

Yah it is an issue but the author is nitpicking.
And the real issue is how does the OS handle the virtual memory -> real memory mapping.
(windows who knows, apple who knows).

Added this shit.
Poke arround in here.
http://msdn.microsoft.com/en-us/library/ms679305%28VS.85%29.aspx

http://msdn.microsoft.com/en-us/library/ms680553(VS.85).aspx ReadProcessMemory Function
where u can read virtual memory per thread.

http://msdn.microsoft.com/en-us/library/ms680348(VS.85).aspx
LDT_ENTRY Structure
Describes an entry in the descriptor table. This structure is valid only on x86-based systems.
Go make ur own debugger with those functions.

Then see what is happening in the selector structure in windows.
It is confusing since it seems that different threads seem to be able to have different selectors.

Who the fuck knows Smiley.
« Last Edit: September 13, 2008, 02:22:46 PM by nop_90 » Logged
vsloathe
vim ftw!
Global Moderator
Lifer
*****
Online Online

Posts: 1049



View Profile
« Reply #7 on: September 13, 2008, 06:53:38 PM »

What I've always found funny is how foreign a concept "protected" memory is in Windows. Pre-Vista (and probably post-Vista, considering you need to have admin privs to do damn near anything), any process could read from and write to the memory of another process.

It's how many game hacks and "trainers" are created. You really don't even have to "hook" the process, you can literally just scroll through all the memory, looking for a value footprint, and then you have the base address for that app/process.
Logged

nop_90
Global Moderator
Lifer
*****
Offline Offline

Posts: 1225


View Profile
« Reply #8 on: September 13, 2008, 09:22:00 PM »

Memory protection is set by the segment flags in the exe.
Check out definition of PE header.
You can change the values of the flags if u get a hex editor.

You can not randomly change memory values in windows between process.
Trainers work that they act like a loader, and load the program, since they are the parent they are allowed to access the memory of the child.
Basically the same shit in linux when u are using a debugger.
Logged
vsloathe
vim ftw!
Global Moderator
Lifer
*****
Online Online

Posts: 1049



View Profile
« Reply #9 on: September 14, 2008, 08:02:26 PM »

Not necessarily man. It's pretty damned easy when running as admin (default mode in XP) to just search through memory. I used to do it all the time. For...projects...and stuff.  ROFLMAO
Logged

perkiset
Olde World Hacker
Administrator
Lifer
*****
Online Online

Posts: 6011



View Profile
« Reply #10 on: September 14, 2008, 08:40:59 PM »

I think we must've been involved in some of the same, you know, school projects and such mang Wink

My first real hacks were with a card that "froze" the memory on an Apple ][ so that you could walk the assembly and patch away from copy protection see how games were written. It was pretty sweet and easy, and made a great training ground for ... um, other stuff.
Logged

Don't make me... Get off my lawn.
emonk
Rookie
**
Offline Offline

Posts: 44


View Profile
« Reply #11 on: September 15, 2008, 11:55:38 AM »

You can not randomly change memory values in windows between process.

 Yes, you can, as long as you are the administrator. There's hooking, loadlibrary, createremotethread, writeprocessmemory, and all kinds of other neat goodies built in to make it easy for you!

 Even failing that the old shatter attack will still (in Vista) get you into another processes context as long as its running under the current user and that has the same or lower 'integrity level' which defaults to medium.

 Then there's the sneaky shit, but why bother making it hard on yourself?*

 *If you're bored though: ntdll!RtlCreateUserThread@kernel32!ExitThread, ntdll!NtQueueApcThread@kernel32!LoadLibraryEx, kernel32!ResumeThread,  kernel32!WaitForSingleObject worked for me during my two week stint as a Vista user.
Logged
Pages: [1]
  Print  
 
Jump to:  

Perkiset's Place Home   Best of The Cache   phpMyIDE: MySQL Stored Procedures, Functions & Triggers
Politics @ Perkiset's   Pinkhat's Perspective   
cache
mart
coder
programmers
ajax
php
javascript
Powered by MySQL Powered by PHP Powered by SMF 1.1.2 | SMF © 2006-2007, Simple Machines LLC
Seo4Smf v0.2 © Webmaster's Talks


Valid XHTML 1.0! Valid CSS!