WEBVTT 00:00.380 --> 00:00.810 Hey everybody. 00:00.810 --> 00:03.610 Welcome to the mini module called memory. 00:03.630 --> 00:09.440 Now we're gonna go over a little bit of what memory is and the different aspects of it. 00:09.510 --> 00:11.010 Now what is memory. 00:11.010 --> 00:17.040 Memory is in a nutshell a physical chip on your machine that's used to hold chunks of data while the 00:17.040 --> 00:18.900 computer is running. 00:18.900 --> 00:25.080 Now this is volatile data so it will be gone when your machine turns off. 00:25.080 --> 00:28.160 This is commonly used to store the program code. 00:28.200 --> 00:34.770 Some of the data around it the kernel all the all applications will use memory in some way shape or 00:34.770 --> 00:35.400 form. 00:35.400 --> 00:42.890 This also includes the operating system and most memory is related to his ram at least in this war. 00:42.910 --> 00:45.900 And we talked about in this case which is random access memory. 00:46.140 --> 00:50.670 And this is called random access because it doesn't have to go through the whole chip defined one bit 00:50.670 --> 00:51.150 of data. 00:51.150 --> 00:57.510 It can go directly to the data without having to go through the full set. 00:57.510 --> 01:05.630 Now how is it used in an operating system now an application will load the data itself into memory. 01:05.640 --> 01:12.750 So the program code for example when we looked at the P E files the loading all of those tables all 01:12.750 --> 01:19.770 the code segments the data segments the BSF segments all of that stuff gets loaded into memory and an 01:19.770 --> 01:22.280 application has an entry point. 01:22.290 --> 01:28.560 So you might have seen this as the word main in another in most applications but there's an entry point 01:28.590 --> 01:36.060 or an entry memory address for an application for every application an E IP will start executing and 01:36.060 --> 01:40.420 moving through the code based on where the entry point is. 01:40.570 --> 01:43.700 Now there is virtual memory as well. 01:43.780 --> 01:47.170 So it's not just all physical memory it's virtual as well. 01:47.200 --> 01:49.470 So what happens is this is also called swaps. 01:49.480 --> 01:55.030 So when a machine is too memory intensive maybe we're running closed out of memory. 01:55.030 --> 02:02.140 It'll start converting to something called swap now swap loads parts of memory regions onto the harddrive 02:02.230 --> 02:06.590 instead of into ram the ram chip itself. 02:06.590 --> 02:14.750 Now this is done to conserve the space it's also done to not allow you to run out of memory. 02:14.870 --> 02:19.670 There's thresholds that you can set on on most systems we're not going to go over that in this particular 02:19.670 --> 02:20.430 video. 02:20.540 --> 02:25.760 But what's important to note is swap is much slower to read because it has to go to the drive. 02:25.760 --> 02:31.310 Find out where the data is load the data back in the memory and then reformat it back into a memory 02:31.310 --> 02:37.000 structure which is a lot slower than just having it ready and available. 02:37.040 --> 02:43.850 So it's important to understand that we're not going to go into swaps specifically feel free to read 02:43.850 --> 02:50.720 up a little bit more on swap in general but swap is enabled on most systems now the memory structure 02:50.720 --> 02:52.480 here is a loose term. 02:52.850 --> 02:59.870 What we're going to be looking mainly at is the stack in the heap which we have our own videos for now. 02:59.990 --> 03:06.790 Memory also contains readable and non readable regions or sections as well as executable and non executable. 03:06.800 --> 03:13.280 This is important to know because if you get something called a you know access read only memory that 03:13.280 --> 03:19.490 means you're trying to write data to a read only memory address which is a non rateable section. 03:19.490 --> 03:25.100 Now it's important to know that because of as a red timer because when you start building exploits or 03:25.100 --> 03:29.990 working with exploits you may run into one of these problems where the memory address you over flown 03:29.990 --> 03:35.230 to is either not executable or not rateable and you need to be able to work around that.