creator cover Process Memory Map
Process Memory Map

Process Memory Map 

1subscriber

2posts

About

Process Memory Map (PMM) is a free Windows utility that Alexander (Rouse_) Bagel has been developing for over 15 years.
 
The tool is open source (MPL-2.0) and available on GitHub — used by reverse engineers and developers worldwide. The repository currently has 171 stars and 28 forks.
 
This page supports PMM and other standalone projects that are used as building blocks of the utility:
  • FWZip — a cross-platform engine for working with ZIP archives
  • FWHexView — a specialized HEX editor
  • CPUView — a project related to PMM that uses its codebase for more convenient ASM debugging inside the Lazarus IDE
  • uni_profiler — a cross-platform profiler used to optimize all of the products listed above

The utility is completely free and will stay that way.
 
A tool that saves you hours of debugging has been built over 15 years by one person, in their spare time. If it's helped you — great! You can support its continued development with a donation.
 
This is where updates, interesting technical details from releases, and everything happening around the project will show up.
FeedMedia
Sep 01 16:13

What is Process Memory Map


Process Memory Map builds a detailed memory map of a running process, continuing the idea behind Mark Russinovich's VMMap, but with much deeper analysis:
  • displays heaps, thread stacks, TEB/SEH frames, and the call stack
  • maps loaded PE images into sections, entry points, and structures
  • parses PEB, LOADER_DATA, ACTIVATION_CONTEXT_DATA, KUSER_SHARED_DATA, and many other structures in a human-readable form
  • built-in x86/x64 disassembler based on DiStorm
  • detects hooks in the import/export tables, delayed imports, andTLS callbacks
  • compares the state of memory blocks using checksums — useful, for example, for spotting changes in hacked software
  • can search process memory, supports debug information via DWARF 1–3 and MAP files
  • displays a list of resources used across all process modules
  • displays extended information about all windows of a remote process, including OS-level restricted information on window/dialog procedures and instances


Why this is an active project, not an abandoned side project

The latest release is 1.6.52, from July 28, 2026, and updates come out regularly.
Coming soon: support for debug PDB files. Further down the roadmap: full DWARF 4/5 support, moving the disassembler to a new custom-built engine, adding FWHexView as a viewer (already implemented and proven in the CPUView project), and more.
 
Source code, documentation, and the full changelog are on GitHub: 
https://github.com/AlexanderBagel/ProcessMemoryMap
Sep 28 19:54

Release 1.7.53: full resource browser and a new remote window inspector

1. A fully completed module for working with a remote process's resources.

There is no longer a need to manually browse every library used by the process to find a specific resource (an image, for example).
 
This mode — triggered with Ctrl+R (or via the menu View → Show Resources...):
  • Groups all resource-bearing modules of the process into a tree
  • Enables quick filtering by resource type, provides previews known resource types
  • Lets you export a resource to disk in various formats.


Preview:

Among graphic resources, the following formats are supported for preview: BMP, ICON, CURSOR, PNG, JPEG, GIF, WMF, TIFF, SVG.
SVG uses a custom renderer built on the Image32 framework.
 
For RT_GROUP_CURSOR and RT_GROUP_ICON types, a separate generator renders the entire image group as a single image.
 
Animated RIFF containers are supported: AVI, ANIICON, ANICURSOR.
 
Standard resource types are decoded into an RC script: RT_VERSION, RT_STRING, RT_ACCELERATOR, RT_MENU, RT_DIALOG.
 
The RT_MESSAGETABLE resource is decoded into an intermediate string representation.
 
All other resources are processed by an analyzer that detects string data in UTF8, UTF16, UTF16BE, and ANSI encodings and displays it as plain text.
 
There are also three dedicated decoders for Delphi/Lazarus-specific resources: DVCLAL, PackageInfo, and DFM.
Subscription levels0
No subscription levels
Go up