(MemMAP is a tool inspired by j00ru's KernelMAP. I've written my own version with a couple more interesting features. A list follows:
* More memory types included (kernel thread stacks and GDI objects)
* Ability to visualize the memory of a user-mode process
* Help dialog with description of memory types
* Refresh feature
When run without arguments, it will display a map of kernel memory. You can visualize a process by running "memmap -p <process id>". To refresh, press F5. To show help, press F1.
The framed area is organized such that the top-left corner is address 0x80000000, and the bottom right corner is 0xFFFFF000 (or, for user-mode processes, 0x00000000 - 0x7FFFF000). Each pixel represents one page of memory (4096 bytes).)
收藏
