executable - windows how to show memory segment of a process? -


we have tools objdump, readelf, , dumbin show executable file contents.

but when executable file loaded memory (a process created), segments in memory different segments in executable file. example, when loaded, 2 segments namely stack , heap allocated (we overlook details of page mapping here).

is there tool show in-time memory segment/status of process?

windows executables use portable executable format. format describes sections of memory allocated when process loaded, , optionally raw data (.text, .data sections) loaded sections.

each section typically have file offset specifying in raw file data located, , virtual address @ data loaded. these may or may not resemble each other.

pe explorer can give details on sections (and else pe file) of executable.

immunity debugger allow attach running process , see memory map.


Comments

Popular posts from this blog

javascript - Unusual behaviour when drawing lots of images onto a large canvas -

how can i manage url using .htaccess in php? -

javascript - Chart.js - setting tooltip z-index -