English | Русский
A utility for displaying the memory map of a process.
Displays the following data:
- process heaps
- thread data: stack, TEB, SEH frames and CallStack
- information about loaded PE files, broken down by sections, with entry points of every loaded image and their structures
- PEB data, PEB_LDR_DATA, Process Parameters
- KUSER_SHARED_DATA data, ACTIVATION_CONTEXT_DATA, ApiSetNameSpace, and others
- built-in x86/x64 disassembler (based on DiStorm)
Provides the ability to:
- analyze memory for installed hooks in import/export/delayed import tables
- analyze installed hooks in exported functions, entry points and TLS callbacks
- analyze memory blocks based on their checksums (for example, to show changes in cracked software)
- search process memory
Additional features:
- lists exported functions
- lists resources
- displays process stacks (x86 + x64)
- displays a list of the process’s windows along with their window procedures
- a separate mode for working with process strings
- supports MAP/DWARF/COFF/STUB/PDB debug information (affects the list of recognized functions and the disassembler output)
- displays changes in allocated memory blocks (alloc/realloc/free)
- quick hints for known memory blocks
To build it yourself, you will need:
- the Virtual TreeView component package, version 8.0 or higher: https://github.com/JAM-Software/Virtual-TreeView
- the 2D graphics class library, version 4.9 or higher: https://github.com/AngusJohnson/Image32
- the ZIP archive class library, version 1.0.9 or higher: https://github.com/AlexanderBagel/FWZip
- the Hex View Project component package, version 2.0.16 or higher: https://github.com/AlexanderBagel/FWHexView
The project is built with Delphi 13.1 Florence in "Win32/Release" mode; the 64-bit version of the utility is built automatically and embedded as a resource. ProcessMemoryMap has not been tested with older versions of Delphi, and compatibility is not guaranteed.
- MemoryMap Core - 1.4.40
- RawScanner Core - 1.2.29
- FWZip - 2.0.11
- Hex View Project - 2.0.16
- Distorm - 3.5.3
- Image32 library - 4.9
- optimization of the search engine, search for changes in previously found blocks
- development of a template engine for displaying arbitrary structures
- migration of all currently supported structures to the template engine
- migration of hex dumps and the disassembler to FWHexView
- display of system structures based on data obtained from PDB
- display of mapped information for the resources directory
- display of mapped information for the exceptions and security directories
- display of mapped information for the com+ directory as a tree
- support for DWARF version 5, support for STUB types
- support for JclDebug debug information (possibly as a plugin)
- Added support for debug directories to the TRawPEImage class, property DebugDirList<>
- Added output of IMAGE_DEBUG_DIRECTORY information, including extended information for IMAGE_DEBUG_TYPE_CODEVIEW, with PDB symbol configuration.
- Added support for PDB debug files. In the settings you can choose the loading mode: on attaching to a process, or manually via the storage manager.
- The new PDB symbol storage manager allows cleaning up outdated data and refreshing debug symbols after OS updates.
- Fixed an error reading the "Line Number Program Header" for DWARF4 debug information
- Fixed an error processing R_X86_64_IRELATIVE records when reading .rela.plt in ELF files
- Added checking for new versions of Process Memory Map
- Added English comments
- Cleaned up debug code in the animation control
- The correct file extension is now used when saving animated resources
- For class/dialog/window procedures, the module they reside in is now displayed
- Added a new mode for working with windows of a remote process
- Fixed a long-standing bug in 64-bit heap handling
- Restored correct operation of filters
- Fixed an alignment error when reading the version stream, which could cause reading beyond the stream bounds.
- Added checks when reading process parameters in TMemoryMap.AddPEBData, whose absence previously made it impossible to open some processes.
- Completed the resources mode: added display of icon and cursor groups and SVG, and saving resources to disk
- Restored Windows XP compatibility
- Fixed a DPI issue with the VirtualStringTree control
The full list of updates is in the updates.txt file
As in the original utility by Mark Russinovich, filtering by data type is available. In this case, only memory blocks containing system data (KUSER_SHARED_DATA, PEB, etc...) are shown.
The data of all supported structures is mapped for easier comprehension. For example, this is how the environment block of a 64-bit process looks.
And this is what IMAGE_DOS_HEADER looks like
If it is not known which structure is mapped at the current memory address, the data is displayed in RAW mode. For example, this is the code at the kernel32.dll entry point
The same, but as disassembled code (switch between views via the right-click menu "Show as disassembly" or with the Ctrl+D hotkey):
- For clarity, the disassembler output is formatted.
- The code of known exported functions is preceded by a description.
- The output is formatted so that NOP and INT3 instructions don't clutter the view, and function endings (RET/IRET/RETF) are highlighted.
For quick navigation through known structures there is a table of contents, available via the menu View -> Show Known Data... or with the F2 hotkey
There is a list of all imported/exported functions (Ctrl+E). Data from the debug MAP file (if present; Delphi/C++ MAP files are supported) is added to it as well. Search by both address and function name is available (library names are not searched)
When the information is available, known calls in the disassembler are annotated.
Including calls through the import table.
There is a module for analyzing a process for installed function hooks (F8)
There is a module for demangling thread call stacks, including 32 and 64 bits + 32SEH (F4)
Search results are shown in a separate dialog (Shift+F)
There is a module that displays the windows of the inspected process, with the addresses of window and class procedures and the parameters of each window (Ctrl+W).
The module that displays the resources of all executable files of the process recognizes more than 30 different resource types (Ctrl+R). It includes built-in text viewers and decoders for RC resources and images, including SVG and animations (AVI/ANICURSOR), as well as decoders for Delphi/Lazarus-specific resources (DFM/LFM/DVCAL/PACKAGEINFO). Resources can be saved to disk, both as a compiled RES file and as decoded data.
The new PDB symbol storage manager allows cleaning up outdated data and refreshing debug symbols after OS updates.
And a lot of other interesting things.
If you find the project useful, you can support its development on the author's main project page: