flat assembler
Message board for the users of flat assembler.

Index > Compiler Internals > data section setting PAGE_WRITECOPY

Author
Thread Post new topic Reply to topic
bugmaker



Joined: 27 Jan 2022
Posts: 4
bugmaker 06 Sep 2024, 07:59
section '.data' data readable writeable

In WinDbg I see data segment is marked as PAGE_WRITECOPY.
Should it not be PAGE_READWRITE ?

I see that after writing data in that segment that it changes to PAGE_READWRITE and merges with the import section which is after it.

When launching a program made in Visual Studio there is no segment with PAGE_WRITECOPY.


From Windows documentation:

PAGE_READWRITE 0x04
Enables read-only or read/write access to the committed region of pages. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation.

PAGE_WRITECOPY 0x08
Enables read-only or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_READWRITE, and the change is written to the new page. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation.
This flag is not supported by the VirtualAlloc or VirtualAllocEx functions.[/b]
Post 06 Sep 2024, 07:59
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system
revolution 06 Sep 2024, 08:28
The memory page attributes are set by the OS loader.

The PE output from fasm doesn't produce PAGE_WRITECOPY. It only has readable, writeable and executable.
Code:
format pe console
section 'a' data readable
db 1
section 'b' data writeable
db 1
section 'c' data readable writeable
db 1
section 'd' data readable executable
db 1
section 'e' data writeable executable
db 1
section 'f' data readable writeable executable
db 1    
You can check the output .exe file with any disassembler to confirm.
Post 06 Sep 2024, 08:28
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.