creator cover Process Memory Map
Process Memory Map

Process Memory Map 

1subscriber

3posts

About

Process Memory Map (PMM) is a free Windows utility that Alexander (Rouse_) Bagel has been developing for over 15 years.
 
The tool is open source (MPL-2.0) and available on GitHub — used by reverse engineers and developers worldwide. The repository currently has 171 stars and 28 forks.
 
This page supports PMM and other standalone projects that are used as building blocks of the utility:
  • FWZip — a cross-platform engine for working with ZIP archives
  • FWHexView — a specialized HEX editor
  • CPUView — a project related to PMM that uses its codebase for more convenient ASM debugging inside the Lazarus IDE
  • uni_profiler — a cross-platform profiler used to optimize all of the products listed above

The utility is completely free and will stay that way.
 
A tool that saves you hours of debugging has been built over 15 years by one person, in their spare time. If it's helped you — great! You can support its continued development with a donation.
 
This is where updates, interesting technical details from releases, and everything happening around the project will show up.
FeedMedia
Sep 01 16:13

What is Process Memory Map


Process Memory Map builds a detailed memory map of a running process, continuing the idea behind Mark Russinovich's VMMap, but with much deeper analysis:
  • displays heaps, thread stacks, TEB/SEH frames, and the call stack
  • maps loaded PE images into sections, entry points, and structures
  • parses PEB, LOADER_DATA, ACTIVATION_CONTEXT_DATA, KUSER_SHARED_DATA, and many other structures in a human-readable form
  • built-in x86/x64 disassembler based on DiStorm
  • detects hooks in the import/export tables, delayed imports, andTLS callbacks
  • compares the state of memory blocks using checksums — useful, for example, for spotting changes in hacked software
  • can search process memory, supports debug information via DWARF 1–3 and MAP files
  • displays a list of resources used across all process modules
  • displays extended information about all windows of a remote process, including OS-level restricted information on window/dialog procedures and instances


Why this is an active project, not an abandoned side project

The latest release is 1.6.52, from July 28, 2026, and updates come out regularly.
Coming soon: support for debug PDB files. Further down the roadmap: full DWARF 4/5 support, moving the disassembler to a new custom-built engine, adding FWHexView as a viewer (already implemented and proven in the CPUView project), and more.
 
Source code, documentation, and the full changelog are on GitHub: 
https://github.com/AlexanderBagel/ProcessMemoryMap
Oct 20 16:59

Native PDB Support in Cpu-View

A new mode for working with debug PDB files was experimentally tested in the Cpu-View project (an alternative Asm debugger for Lazarus).
During development, the main problem to be solved was the dependency on dbghlp.dll and symsrv.dll.
The standard dbghlp.dll shipped with the operating system has minimal functionality and does not allow full-featured work with debug symbols — for that, its counterpart from the Windows SDK is required.
For this reason, work with the MSF container (the format in which PDB is stored) was implemented manually, using a custom-written parser that requires no external dependencies and works with PDB in RAW mode.
The second problem that needed solving was that Microsoft stopped releasing debug symbols as installation packages, and all it now provides is symsrv.dll, which works via an external MSIL reference to a symbol server.
As part of this task, utility code was developed that supports working with local symbol stores as well as a network component supporting external network servers, which made it possible to get rid of the dependency on symsrv.dll.
As a result, PDB support provides more debugging information when working in the area of system libraries
 
Sep 28 19:54

Release 1.7.53: full resource browser and a new remote window inspector

1. A fully completed module for working with a remote process's resources.

There is no longer a need to manually browse every library used by the process to find a specific resource (an image, for example).
 
This mode — triggered with Ctrl+R (or via the menu View → Show Resources...):
  • Groups all resource-bearing modules of the process into a tree
  • Enables quick filtering by resource type, provides previews known resource types
  • Lets you export a resource to disk in various formats.


Preview:

Among graphic resources, the following formats are supported for preview: BMP, ICON, CURSOR, PNG, JPEG, GIF, WMF, TIFF, SVG.
SVG uses a custom renderer built on the Image32 framework.
 
For RT_GROUP_CURSOR and RT_GROUP_ICON types, a separate generator renders the entire image group as a single image.
 
Animated RIFF containers are supported: AVI, ANIICON, ANICURSOR.
 
Standard resource types are decoded into an RC script: RT_VERSION, RT_STRING, RT_ACCELERATOR, RT_MENU, RT_DIALOG.
 
The RT_MESSAGETABLE resource is decoded into an intermediate string representation.
 
All other resources are processed by an analyzer that detects string data in UTF8, UTF16, UTF16BE, and ANSI encodings and displays it as plain text.
 
There are also three dedicated decoders for Delphi/Lazarus-specific resources: DVCLAL, PackageInfo, and DFM.
Subscription levels0
No subscription levels
Go up