VMExplorer

Project Description
VMExplorer is a tool that helps developpers analyze the virtual memory of a process and explore its user address space.

The current version includes the following features:

• Map view and a list view of the userland
• Memory analysis report generator
• List of identified objects that are loaded in memory (modules, heaps, thread stacks, system objects, ...)
• Simple Hexadecimal viewer
• Page/Region/Memory object property viewer
• Automatic memory objects update

Future enhancements include:

• Ability to open crash dump files
• Save and load projects
• Record and replay memory events
• Documentation (internal like tooltips, and external).
• Statistics module for heap fragmentation.
• Dynamic creation of memory object description
• Enhanced hexadecimal viewer that takes into account memory object description
• Basic disassembler for function pointers

Compatibility note
VMexplorer was developped and tested on Win XP 32 bits.
The code relies on undocumented Windows API and data structures that are subject to change from version to versions.
No work was done until now on the compatibility with Windows Vista and 64 bits platforms.


Screenshots


Main window with map view


Main window with list view


Memory report : summary


Memory report : modules


Memory report : heaps