1

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says:

Type: Section
Description: A memory mapped file or paging-file...
Address: 0xFFFFF8A002D8A080

But when I look into x64dbg Memory Map tab, there is no such addresses. I see only range 0000000000010000-000007FFFFFE0000. How I can find memory mapped file? I want to place memory breakpoint on it.

  • 2
    0xFFFFF8A002D8A080 is probably the kernel address, not the user-mode address. I guess you can use x64dbg memory search command to find the file content mapped into your process user-mode address. – Tal Nov 8 '16 at 14:13
  • 1
    @Tal yes, process explorer shows kernel address. Good idea with searching memory, it should work. – Zergatul Nov 10 '16 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.