2

How to get the memory-mapping (e.g. library) that contains a given address in Radare?

I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address.

Now, I want to know which memory-mapping the address corresponds to, e.g. is it libc?

How can I obtain the memory-mapping whose memory region contains the given address?

2

With the command dm. you can show the map name of the current address. To change the current address to your desired one add @ address

For example:

[0x7f8622478090]> dm. @ 0x00007f8622477000 0x00007f8622477000 - 0x00007f8622478000 * usr 4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so

You can combine your search directly with the dm. command:

dm. @@/ STRING
  • Why does your 'dm.' command return multiple .so's? – Shuzheng Dec 9 '18 at 7:17
  • Both are the same. The first one is the name and the other one the file itself. If you're a little bit familiar how to look at radare's code you can find this spot inside the file libr/debug/map.c in the function print_debug_map_line – defragger Dec 9 '18 at 8:19
  • Thank you @defragger. How come ld-2.28.so is only r--? In my case libc-2.28.so is also marked r--, which means it is only readable, but not executable? – Shuzheng Dec 9 '18 at 13:59
  • Yes in my case ld-2.28.so has also the following maps: 0x00007f6e3273b000 - 0x00007f6e3273c000 - usr 4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so 0x00007f6e3273c000 - 0x00007f6e3275a000 * usr 120K s r-x /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.r_x 0x00007f6e3275a000 - 0x00007f6e32762000 - usr 32K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.r 0x00007f6e32762000 - 0x00007f6e32764000 - usr 8K s rw- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.rw – defragger Dec 9 '18 at 14:10
  • How do you get all those maps? I see only a few using the dmm command. – Shuzheng Dec 9 '18 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.