NationalSecurityAgency/ghidra · error · ValueError

Address {address} is not in process {proc}

Error message

Address {address} is not in process {proc}

What it means

Raised by DefaultMemoryMapper.map_back when the Address's space attribute does not equal the mapper's configured defaultSpace (typically 'ram'). The default x64dbg memory mapper is a simple identity mapper: it maps offsets directly to the single default address space and rejects any address from a different space.

Source

Thrown at Ghidra/Debug/Debugger-agent-x64dbg/src/main/py/src/ghidraxdbg/arch.py:155

def compute_ghidra_lcsp() -> Tuple[str, str]:
    lang = compute_ghidra_language()
    comp = compute_ghidra_compiler(lang)
    return lang, comp


class DefaultMemoryMapper(object):

    def __init__(self, defaultSpace: str) -> None:
        self.defaultSpace = defaultSpace

    def map(self, proc: int, offset: int) -> Tuple[str, Address]:
        space = self.defaultSpace
        return self.defaultSpace, Address(space, offset)

    def map_back(self, proc: int, address: Address) -> int:
        if address.space == self.defaultSpace:
            return address.offset
        raise ValueError(f"Address {address} is not in process {proc}")


DEFAULT_MEMORY_MAPPER = DefaultMemoryMapper('ram')

memory_mappers: Dict[str, DefaultMemoryMapper] = {}


def compute_memory_mapper(lang: str) -> DefaultMemoryMapper:
    if not lang in memory_mappers:
        return DEFAULT_MEMORY_MAPPER
    return memory_mappers[lang]


class DefaultRegisterMapper(object):

    def __init__(self, byte_order: str) -> None:
        if not byte_order in ['big', 'little']:
            raise ValueError("Invalid byte_order: {}".format(byte_order))

View on GitHub (pinned to d5f144c24d)

Solutions

1. Verify the Address.space matches the mapper's defaultSpace before calling map_back.
2. Register a custom DefaultMemoryMapper subclass in arch.memory_mappers for the target language that handles multi-space addresses.
3. Confirm the Ghidra language selected via compute_ghidra_lcsp uses a space compatible with 'ram'.

Example fix

# before: address from wrong space passed blindly
offset = mapper.map_back(proc, address)  # space != 'ram' raises

# after: validate space before mapping
if address.space != mapper.defaultSpace:
    raise ValueError(
        f"Address space '{address.space}' != mapper space '{mapper.defaultSpace}'")
offset = mapper.map_back(proc, address)

mm = arch.compute_memory_mapper(language)
if address.space != mm.defaultSpace:
    raise ValueError(
        f"Address space '{address.space}' does not match mapper space '{mm.defaultSpace}'")

def address_in_default_space(addr: Address, mapper: 'DefaultMemoryMapper') -> bool:
    return addr.space == mapper.defaultSpace

try:
    offset = mapper.map_back(proc, address)
except ValueError:
    # address space mismatch; fall back or report
    raise RuntimeError(f"Cannot map address {address}: unsupported space")

When it happens

Trigger: map_back(proc, address) is called during write_mem or memory operations. The Address object's .space field is not 'ram' (or whatever defaultSpace was configured), so the guard triggers.

Common situations: A multi-space address (e.g. from a Ghidra language with separate code/data spaces) was passed to the default identity mapper. The trace was started with a language whose address-space schema does not match the hardcoded 'ram' default. A custom memory mapper was not registered for the target language.

Related errors

• Address {address} is not in process {proc}
• Invalid byte_order: {}
• Cannot convert {}'s value: '{}', type: '{}'
• No memory mapper
• Address {address} is not in process {proc}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/1cb699467f58e997. Report an issue: GitHub.