The Memory Map window displays a list of memory blocks that make up the memory structure of the current program. The component provides actions for adding, renaming, moving, splitting, extending, joining, and deleting memory blocks.
When working with a versioned program within a
shared project an exclusive checkout of the program project file is required to perform any
modifications to the memory map.
Ghidra supports three different block types through the Memory Map window:
File Bytes are currently only created
by importers. At this point in time there is no capability provided by the Memory Map provider to create a
new File Bytes instance.
Overlay - Each of the above memory block types may optionally be specified as an Overlay at the time of creation. If this option is selected, the block is created in a new overlay address space. Overlay blocks can serve various purposes where a memory range may contain different data/code or map to different areas of memory at any given point in time or processor state. Note that overlay blocks are fixed and may not be moved, split, merged or expanded. In addition, Overlays do not relocate with image base changes and have significant limitations in conjunction with decompilation and analysis.
To view the Memory Map, select Window
Memory Map from the main tool menu, or click on the
icon in the tool bar. Note that the current Image Base Address is
specified within the title bar.
Each row displays information about one of the memory blocks. The following summarizes the information about each block.
Name - Name of the memory block.
Start - The starting address (in hex) of the memory block.
End - The Ending address (in hex) of the memory block.
Length - The length (in hex) of the memory block.
R - Indicates read permission.
W - Indicates write permission.
X - Indicates execute permission.
Volatile - Indicates a region of volatile I/O Memory.
Overlay - Indicates if block is defined as a memory overlay.
Type - Indicates whether the block is a Default, Bit Mapped or Byte Mapped type of block.
Initialized - Indicates whether the block has been initialized with values; this property applies to Default and Overlay blocks.
Byte Source - Provides information about the source of the bytes in this block. If the bytes were originally imported from a file, then this will indicate which file and the offset into that file. If the bytes are mapped to another region of memory, it will provide the address for the mapping. Blocks may consist of regions that have different sources. In that case, source information about the first several regions will be displayed.
Source - Description of block origination.
Comment - User added comment about this memory block.
Rename
Memory Blocks can be renamed by double-clicking on the name field and entering a new name.
Change Read Permission
The read permission of a memory block can be changed by left-clicking on the checkbox.
Change Write Permission
The write permission of a memory block can be changed by left-clicking on the checkbox.
Change Execute Permission
The execute permission of a memory block can be changed by left-clicking on the checkbox.
Change Volatile Setting
The volatile setting of a memory block can be changed by left-clicking on the checkbox.
Initialize Memory Block
A memory block that is currently Uninitialized can be Initialized by clicking on the Initialized checkbox. A dialog will appear allowing you to enter a byte value to be used to fill the block. Deselecting the checkbox will cause the block be revert to uninitialized memory. This will have the additional side effect of removing all functions, instructions, data, and outgoing references in that block.
Edit Comment
Memory Block comments can be changed by double-clicking on the comment field and entering the new comment. The comment can be a maximum of 256 characters.
The memory block operations are available through the icons on the header of the Memory Map window, or select a block in the table, right mouse click, and choose an option.
Select Add to bring up the Add Memory Block dialog. Fill in the requested information and select the OK button.
![]() |
Block Name - Enter the name of the new memory block.
Start Addr - Enter the start address of the new memory block. If the program language defines multiple address spaces, the address space must also be specified. The address space selection will not appear if only one is defined. Overlay spaces are not included in the list of spaces. Within the defaul address space, a block may not span across the current Image Base Address.
Length - Enter the length of the new memory block.
Comment - Enter a comment for the block if desired.
Read - Sets the read permission.
Write - Sets the write permission.
Execute - Sets the execute permission.
Volatile - Marks this block as volatile I/O memory.
Overlay - Creates the block as an overlay within a corresponding overlay address space.
Block Types - Select the block type from the combo box: Default, Bit Mapped or Byte Mapped.
- Default - A normal memory block within the processor's address space. These blocks cannot overlap any other default block. Default blocks can be one of the following types:
- Initialized - Specify a value and a new block will be created using that value for every byte in the block.
- Uninitialized - An uninitialized block will be created.
- File Bytes - Select from a list of imported files and enter a starting offset for that file. Those bytes will be the initial value for the block.
You can use the "Add To Program" using "Binary Import" to create new FileBytes that you can use here.
- Bit Mapped - This is a block that allows bit addressing of a section of bytes in memory. For example, the first bit of the byte at memory location 0x1000 might also be addressed as BIT:0. The second bit at the same byte would then be addressed as BIT:1 and so on.
The illustration below depicts a Bit Mapped block of Length 16 with a Start Addr of (BIT:) 0000, and a Source Address of 00008100. Note that bit-mapped addresses are assigned from least significant bit to most significant bit.
This is used to model certain processors that allow this sort of addressing such as the INTEL 8051. When a Bit Mapped block is created you must specify the byte address on which the bit addressing will be based.
- Byte Mapped - This is a block that allows access to a range of bytes in memory using an alternative address. A Source Address must be specified which corresponds to the source of the actual bytes for this block, although all or part of the mapping may correspond to an uninitialized block or no block at all. The default mapping ratio is 1-byte to 1-source-byte (1:1), although other decimations may be specified using a mapping ratio. When specifying a Mapping Ratio both values must be in the range 1..127 where the right (source-byte count) value must be greater-than-or-equal to the left value (e.g., 2:4).
![]() |
Select Move to bring up the Move Memory Block dialog. The Move action is enabled when exactly one memory block is selected. Enter either a new start or end address to cause the block to be moved.
![]() |
Name - Name of the memory block to be moved (not editable).
Start Address - Current starting address of the block to be moved (not editable).
End Address - Current ending address of the block to be moved (not editable).
Length - Length of the memory block to be moved (not editable).
New Start Address - Enter the NEW starting address for the block. The NEW ending address will be computed.
New End Address - Enter the NEW ending address for the block. The NEW starting address will be computed.
You cannot move a block under the following conditions:
- The changes specified would result in an overlap with the original block or any other existing block.
- The block is an Overlay block.
Select Split to bring up the Split Block Dialog. The Split action is enabled when exactly one memory block is selected. Use the Split Block Dialog to split a memory block into two smaller memory blocks. There are four ways to enter the split point:
- Enter an end address for the first block (block to split), or
- Enter a length for the first block (block to split), or
- Enter a start address for the second block (new block), or
- Enter a length for the second block (new block).
![]() |
Block to Split
Block Name - Name of block being split (not editable)
Start Address - Start address of block being split (not editable)
End Address - New end address of the original block
Block Length - New length of original block
New Block
Block Name - Name of new block. Default name will be provided, but it can be changed by editing this field
Start Address - Start address for the new split block
End Address - End address of the original block (not editable)
Block Length - Length of new split block
Overlay type blocks cannot be split.
Select Expand Up to bring up the Expand Block Up Dialog. The Expand Up action is enabled when exactly one memory block is selected. Use the Expand Block Up Dialog to cause a memory block to grow by adding additional bytes BEFORE the memory block. The block can be expanded by either entering a new start address or a new length.
![]() |
New Start Address - A new start address can be entered here. It must be before the current start address.
End Address - Displays the end address of the block (not editable).
Block Length - Displays the length of the block. A new value can be entered here which will cause a corresponding change in the start address.
Overlay type blocks cannot be expanded.
Select Expand Down to bring up the Expand Block Down Dialog. The Expand Down action is enabled when exactly one memory block is selected. Use the Expand Block Down Dialog to cause a memory block to grow by adding additional bytes AFTER the memory block. The block can be expanded by either entering a new end address or a new length.
![]() |
Start Address - Displays the start address of the block (not editable).
New End Address - A new end address can be entered here. It must be after the current end address.
Block Length - Displays the length of the block. A new value can be entered here which will cause a corresponding change in the end address.
Overlay type blocks cannot be expanded.
The Merge action is enabled when two or more memory blocks are selected. It attempts to merge all selected blocks into one block. Any "gaps" will be "filled in" with 0s.
Caution should be used because a VERY large memory block can be created if the memory blocks being merged are far apart in the address space. Ghidra will display a warning if a really large block is about to be created. Disregarding the warning may cause Ghidra to fail with an "out of memory" error.
Only adjacent Default blocks of the same initialization state can be merged.
Overlay type blocks cannot be merged.
The Delete action is enabled when one or more memory blocks are selected. All selected blocks will be deleted. If the blocks contained defined data or instructions, a confirmation dialog is displayed; select "yes" on the dialog to delete the block. A progress dialog is displayed while the block is being deleted.
For large blocks that may contain many symbols, references, instructions, etc., the delete operation may take a while to complete. You can cancel the delete operation at any time.
The Set Image Base action allows you to change the base address of a program. This action is useful when working with relocatable code such as DLLs or shared objects. All addresses, code units, references, etc. will immediately be re-based relative to the new base address.
For example, given a program base at 0x01000000 with a memory block starting at address 0x01001000. If the base address was changed to 0xeeee0000, then the new start address of the memory block would become 0xeeee1000.
To change the image base, enter a new image base in the text field and click on the OK button.
|
Provided by: Memory Map Plugin