MemoryHacker

[CodeCracker]

MemoryHacker is a tool which can search for values on the target process!
You can use to search/write in the memory of a process.
Can be used for finding information for creating trainers/memory hacking.

First Select a process then do a right mouse click on it and choose "Memory hack",
A new dialog with options will come,
with search type: Full search or Custom search (Customize button),
Customize dialog contains list with Start Address/End Address
in order to perform search only on these ranges.
You can pick up a Module or a memory block.

Type combo specifies the type of variables to search
can be: byte, word, dword, qword, bytes, ASCII string, UNICODE string, float or double.

Base combo specifies the base of "Value to search",
decimal = base 10 and hexadecimal = base 16.

First time you enter "Value to search" and click on "Search" button
in order to find addresses and they will be added to list (Address/Value)

"New value" textbox is used only when you press "Patch" button,
holds the new value to be set!

They are three more options when you right click on list(Address/Value)
"Copy Selected", "Remove Selected" and "Patch Selected".

Read button will read current values of list (Address/Value).

"Remove Not Found" button will read current values of list (Address/Value)
and will remove from list (Address/Value) the ones which
are not equal with "Value to search".

"Patch" button will patch all values of list (Address/Value)
with "New value".

Let me know about any bug or if you have any suggestion.
Source code (Visual C++ 6.0) released.

In MemoryHacker_fixed1:
- now "Remove Not Found" remove addresses for which read fails (probable due to memory being set free)
- Added "Suspend process", "Resume process" and "Get process state" in main dialog

[Trit0n]

Very good and simple tool.
I have never seen anything so simple.
Tip:
if you can't find all the processes in the list.
then use the tool “PowerRun”
(Runs the program as “TrustedInstaller or Nt Authority/system”)
https://www.sordum.org/9416/powerrun-v1-7-run-with-highest-privileges/
(Also applies to all other memory tools such as Winhex, 010Editor and many more)

[CodeCracker]

MemoryHacker_fixed2:
- Fixed buffer overflow posted by jackyjask
- Fixed conversion of MemoryBlock protection to string
- in "Inspect Memory" dialog added "Split string len"; and also added vertical scroll

[yoza]

Awesome.. as always !

[Mavrick]

Originally Posted by yoza

Awesome.. as always !

A thank you post from a mod. What irony!