Debugger: Memory (Dynamic Bytes)

The memory, or dynamic bytes, window is analogous to Ghidra's bytes window for static analysis, but in the dynamic context. That is, it displays memory contents from a target. More precisely, it displays recorded memory contents in a trace. In most use cases, that trace is "at the present," meaning it is the most recent memory from a live target. Multiple memory windows can be displayed simultaneously, using the same pattern as many other Ghidra windows. The "primary" window is always displayed and generally tracks with the rest of the tool. Any window can be "snapshotted," i.e., duplicated. This is where memory windows differ from static bytes windows. Static snapshots remain in place; they do not automatically navigate. Dynamic snapshots can still be configured to navigate, following the rest of the tool. A common use is to configure a "snapshot" to follow the stack pointer. Still, you can disable a window's automatic navigation, so it behaves like a true snapshot. A current limitation is that you cannot use snapshots to display different points in time for the same trace.

Because not all memory is recorded, some background coloring is used to indicate the state of attempted memory reads. Regardless of state, the most-recent contents, as recorded in the trace, are displayed in the window, defaulting to 00. "Stale" memory, that is ranges of memory which have not been read at the current time, are displayed with a darker background. Where that memory is marked "read-only" and has been successfully read previously, that coloring is subdued, since the contents are not likely to have changed. Where a read was attempted but failed, the first address in the failed range is displayed with a pink background. Otherwise, up-to-date contents are displayed with the default background color.

NOTE: Modification of trace byte contents is a work in progress. At the moment, the feature is simply disabled. In general, modifications to bytes when the window is "at the present" are directed to the target. Otherwise, they simply modify the historical or emulated values stored in the trace. A modification at a given time remains in effect, but stale, for all future times up to but excluding the time of the next recorded value.

Actions

The memory window provides a variety of actions, some for managing and configuring windows, and others for capturing memory from a target.

New Memory View

This action is always available in the Window → Debugger menu. It creates a new memory window with the same configuration as the primary memory window. It is equivalent to "snapshotting" the primary memory window.

Follows Selected Thread

This action is only available on snapshot memory windows. The primary window always follows the tool's current thread. Disabling this toggle causes the snapshot to remain on its own current thread rather than following the tool's. The current thread is used when computing a location to navigate to automatically. It is only applicable when "Track Location" is set to something other than "Do Not Track."

Track Location

This action is always available on all memory windows. It configures automatic navigation for the window. When location tracking is enabled, the window is automatically navigated to an address computed from the trace's or target's machine state. The address is also highlighted in green. The computed address is affected by the tool's current "coordinates," that is the selected thread, frame, and point in time. The options are pluggable, but currently consist of:

Go To (G)

This action is available whenever a trace is active in the window. It prompts the user for an address, which can be expressed in Sleigh, then attempts to navigate to it. The expression is evaluated in the context of the current thread, frame, and point in time. If the current trace is live and at the present, the target may be queried to retrieve any machine state required to evaluate the expression.

Read Memory

This action is available when the current trace is "at the present" with a live target, and there is a selection of addresses in the memory window. It will instruct the recorder to read and record the contents of memory for the selected range(s). Typically, the viewable addresses are automatically read — see the Auto-Read action.

Auto-Read Memory

This action is always available on all memory windows. It configures whether or not the memory range(s) displayed in the window are automatically read and recorded. Like the Read Memory action, it is only permitted when the current trace is "at the present" with a live target. It occurs when the user scrolls the window, or when the window is otherwise navigated to a new location. Note that other components may read memory, regardless of this windows's configuration. For example, the recorder typically reads the page of memory pointed to by the program counter. In other words, this action cannot "disable all memory reads." The options are pluggable, but currently consist of:

Byte Viewer Options

This action does the same as it does for the static context.

Toggle Editing

This action does the same as it does for the static context. NOTE: This feature is currently disabled, as it is a work in progress.

Tool Options: Colors

The memory-state and tracked-location background colors are replicated from the Dynamic Listing.