[a_d_13]

Hello,

MemMAP is a tool inspired by j00ru's KernelMAP (see here). I've written my own version with a couple more interesting features. A list follows:

• More memory types included (kernel thread stacks and GDI objects)
• Ability to visualize the memory of a user-mode process
• Help dialog with description of memory types
• Refresh feature

When run without arguments, it will display a map of kernel memory. You can visualize a process by running "memmap -p <process id>". To refresh, press F5. To show help, press F1.

The framed area is organized such that the top-left corner is address 0x80000000, and the bottom right corner is 0xFFFFF000 (or, for user-mode processes, 0x00000000 - 0x7FFFF000). Each pixel represents one page of memory (4096 bytes). Below are several screenshots:

When run without arguments, on Windows Vista SP1:


Visualizing Microsoft Visual Studio 2008 (memmap -p 5976):


Help window:


If there's a bug, please let me know! Please note that I offer no guarantees about this program - it does not write to memory, and does not load a kernel-mode driver, but it might still crash a process. Do not run this on any important system.

Thanks,
--AD

[j00ru]

Wow, impressive ;>
Glad to see that my project became the inspiration for something even more useful ;D
Bah, I guess it could become the ultimate tool in the context of ASLR protection visualization :)
Do you have plans on sharing the source?

Let me enclose two kernel screenshots from the Windows XP SP3 and Windows Vista SP2 kernels ;)

Windows XP SP3:


Windows Vista SP2:


Overall, good job ;)

[EP_X0FF]

Looks cool :)

[Doctor]

hello,
before any thank you for this division.
I have to download your file .zip. It functions but displays me that 3 features red in bottom nothing more. I did something ?, or not done something?

Afflicted for this deplorable English
thks
D.

[EP_X0FF]

hello,
before any thank you for this division.
I have to download your file .zip. It functions but displays me that 3 features red in bottom nothing more. I did something ?, or not done something?

Afflicted for this deplorable English
thks
D.

I assume you're running on x64 OS. I don't think it was designed to be compatible with x64.

[Doctor]

hello, thank you for your answer and sorry for this late answer.
it is really damage.
Would I have a last question if that does not disturb you?
Do you think that this kind of application could be to transform to be to use on a software like Processing?

I thank you

D.