25

Started up remote debugging a C++ project today on a Win 7 machine running in VMWare and was astonished to see the following pattern on a random memory location:

enter image description here

Who might code this (it's not me!) and for what reason?? Just curious if anyone has seen something like this.

Improve this question
3
  • 5
    Yep, agreed. Those look like grey-level colour masks for four zeros. It may just be left-overs from an old bitmap buffer. Don't worry about it unless you start seeing QQ and =P appear everywhere. Then, you should suspect that HAL9000 is messing with your app. Commented Sep 6, 2012 at 23:40
  • 3
    At least it's not some logo for a hacker group bundled with a rootkit. Commented Sep 7, 2012 at 1:29
  • This is an awesome example of how frequency analysis can defeat obfuscation. Commented Sep 7, 2012 at 3:07

2 Answers 2

Reset to default
21

It looks like a rendered mask for a font (each character in a font (typeface+size+style) is rendered once in-memory, then blitted to the output surface) using 8bpp, which suggests you've got font anti-aliasing enabled.

I'm assuming your project involves a GUI, you might be looking at a shared-memory area that GDI uses for storing rasterized fonts.

If not, then this might just be leftover memory from a previous process or OS component that wasn't zeroed before being used by your application.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Perhaps they zeroed it a little too well.
6

It's hard to say. Possibly memory used to buffer some fonts (in this case, zeros), or even buffered printer or screen content.

Improve this answer

4 Comments

It's unlikely to be from a screen or window buffer because it's 8bpp.
Well, assuming a modern display, you're right. I've updated my answer to include printers.
Awesome, thanks! Of course, how could I miss it. I thought I'm going crazy when I first saw it :) Too much debugging :)
No, you're all wrong. We're living in the Matrix and you've found a way to tap into the Matrix code. What you're seeing is the very nature of our constructed reality, right before your eyes - except you need to change your IDE's settings to use green-on-black.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.