How to get the memory-mapping (e.g. library) that contains a given address in Radare?

I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address.

Now, I want to know which memory-mapping the address corresponds to, e.g. is it libc?

How can I obtain the memory-mapping whose memory region contains the given address?

New contributor
user111854 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
up vote 2 down vote accepted

With the command dm. you can show the map name of the current address. To change the current address to your desired one add @ address

For example:

[0x7f8622478090]> dm. @ 0x00007f8622477000 0x00007f8622477000 - 0x00007f8622478000 * usr 4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so

You can combine your search directly with the dm. command:

dm. @@/ STRING
  • Why does your 'dm.' command return multiple .so's? – user111854 Dec 9 at 7:17
  • Both are the same. The first one is the name and the other one the file itself. If you're a little bit familiar how to look at radare's code you can find this spot inside the file libr/debug/map.c in the function print_debug_map_line – defragger Dec 9 at 8:19
  • Thank you @defragger. How come ld-2.28.so is only r--? In my case libc-2.28.so is also marked r--, which means it is only readable, but not executable? – user111854 Dec 9 at 13:59
  • Yes in my case ld-2.28.so has also the following maps: 0x00007f6e3273b000 - 0x00007f6e3273c000 - usr 4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so 0x00007f6e3273c000 - 0x00007f6e3275a000 * usr 120K s r-x /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.r_x 0x00007f6e3275a000 - 0x00007f6e32762000 - usr 32K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.r 0x00007f6e32762000 - 0x00007f6e32764000 - usr 8K s rw- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so ; map.usr_lib_ld_2.28.so.rw – defragger Dec 9 at 14:10
  • How do you get all those maps? I see only a few using the dmm command. – user111854 Dec 9 at 14:15

Your Answer

user111854 is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.