A Windows utility for visualizing process memory maps, analyzing hooks, and disassembling code with advanced debugging features.
Process Memory Map is a Windows utility that displays detailed memory maps of running processes. It provides deep insights into process internals including heaps, threads, loaded modules, and system structures like PEB and KUSER_SHARED_DATA, making it invaluable for reverse engineering, debugging, and security analysis.
Windows reverse engineers, security researchers, and low-level developers who need to analyze process memory structures, detect hooks, or debug complex software issues at the memory level.
Developers choose Process Memory Map for its detailed, human-readable visualization of low-level process data, integrated x86/x64 disassembler with call hints, and specialized features like hook detection and memory comparison that simplify complex memory analysis tasks.
Process Memory Map
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Displays process heaps, threads, TEB, SEH frames, and system structures like PEB and KUSER_SHARED_DATA with human-readable formatting, as shown in screenshots of IMAGE_DOS_HEADER and environment blocks.
Includes an x86/x64 disassembler based on DiStorm that formats output, adds call hints for known functions, and integrates export lists and MAP files for enhanced code analysis, as demonstrated in the entry point disassembly screenshots.
Analyzes hooks in import/export tables, delay imports, entry points, and TLS callbacks, providing detailed warnings and addresses, which is invaluable for security researchers and reverse engineers.
Allows comparing memory blocks using checksums to highlight changes (e.g., in cracked software), with results displayed in a dedicated dialog accessed via F5, as shown in the compare result screenshot.
Only works on Windows and requires Delphi 10.4.2 Sydney for building, with no guaranteed compatibility for older versions, limiting accessibility and posing a barrier for developers not using this specific toolchain.
Full support for PDB files and advanced DWARF versions is listed in the RoadMap (e.g., versions 1.8 and 1.9), meaning current capabilities are limited compared to tools with native, out-of-the-box PDB integration.
Building from source requires specific components like Virtual TreeView 8.0+ and FWZip 1.0.9+, along with Delphi 10.4.2, making it cumbersome for developers not already embedded in that ecosystem.