Skip to content

memory.md

Latest commit

 

History

History
43 lines (26 loc) · 1.58 KB

memory.md

File metadata and controls

43 lines (26 loc) · 1.58 KB

Memory management

Speakeasy layers a memory manager on top of the emulator engine and tracks each mapped region with tags and metadata that can be exported in reports.

Memory tagging

Each allocation is tagged with this namespace format:

<origin>.<object_type>.<object_name>.<base_address>

Typical origins:

  • emu: memory mapped by emulator internals (images, stacks, core runtime structures)
  • api: memory allocated via API handlers (for example VirtualAlloc paths)

Memory freezing

Set keep_memory_on_free (or --keep-memory-on-free) to keep mappings after free operations. This is useful when samples allocate, populate, and free buffers quickly but you still need to inspect resulting artifacts.

Memory acquisition mode

In-report snapshots:

  • --snapshot-memory-regions stores region payload refs in the report
  • resolve those refs through the top-level data section, which stores base64(zlib(raw_bytes)) keyed by SHA-256

This keeps memory snapshots self-contained while deduplicating repeated regions across runs.

Memory tracing

Set analysis.memory_tracing (or --analysis-memory-tracing) to track per-region read/write/execute counters and symbol access summaries.

This adds overhead, especially on memory-heavy samples.

Related docs