How to get the memory-mapping (e.g. library) that contains a given address in Radare?

I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address.

Now, I want to know which memory-mapping the address corresponds to, e.g. is it libc?

How can I obtain the memory-mapping whose memory region contains the given address?

1 Answer 1


With the command dm. you can show the map name of the current address. To change the current address to your desired one add @ address

For example:

[0x7f8622478090]> dm. @ 0x00007f8622477000 0x00007f8622477000 - 0x00007f8622478000 * usr 4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so

You can combine your search directly with the dm. command:

dm. @@/ STRING
  • Why does your 'dm.' command return multiple .so's?
    – Shuzheng
    Dec 9, 2018 at 7:17
  • Both are the same. The first one is the name and the other one the file itself. If you're a little bit familiar how to look at radare's code you can find this spot inside the file libr/debug/map.c in the function print_debug_map_line
    – defragger
    Dec 9, 2018 at 8:19
  • Thank you @defragger. How come ld-2.28.so is only r--? In my case libc-2.28.so is also marked r--, which means it is only readable, but not executable?
    – Shuzheng
    Dec 9, 2018 at 13:59
  • Yes in my case ld-2.28.so has also the following maps: 0x00007f6e3273b000 - 0x00007f6e3273c000 - usr 4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so 0x00007f6e3273c000 - 0x00007f6e3275a000 * usr 120K s r-x /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.r_x 0x00007f6e3275a000 - 0x00007f6e32762000 - usr 32K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.r 0x00007f6e32762000 - 0x00007f6e32764000 - usr 8K s rw- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.rw
    – defragger
    Dec 9, 2018 at 14:10
  • How do you get all those maps? I see only a few using the dmm command.
    – Shuzheng
    Dec 9, 2018 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.