Mastering Reverse Engineering

Memory addressing

The start of a piece of data, a series of bytes, stored in the memory can be located using its memory address. Every byte stored in the memory is assigned a memory address that identifies its location. When a program is executed by a user, the executable file is read, then mapped by the system to an allocated memory address. The executable file contains information on how it maps it, so that all executable code is in the code section, all initialized data is in the data section, and uninitialized data is in the BSS section. Code instructions found in the code section are able to access data in the data section using memory addresses, which can be hard-coded. Data can also be a list of addresses pointing to another set of ...