MemoryHacker

[CodeCracker]

MemoryHacker is a tool which can search for values on the target process!
You can use to search/write in the memory of a process.
Can be used for finding information for creating trainers/memory hacking.

First Select a process then do a right mouse click on it and choose "Memory hack",
A new dialog with options will come,
with search type: Full search or Custom search (Customize button),
Customize dialog contains list with Start Address/End Address
in order to perform search only on these ranges.
You can pick up a Module or a memory block.

Type combo specifies the type of variables to search
can be: byte, word, dword, qword, bytes, ASCII string, UNICODE string, float or double.

Base combo specifies the base of "Value to search",
decimal = base 10 and hexadecimal = base 16.

First time you enter "Value to search" and click on "Search" button
in order to find addresses and they will be added to list (Address/Value)

"New value" textbox is used only when you press "Patch" button,
holds the new value to be set!

They are three more options when you right click on list(Address/Value)
"Copy Selected", "Remove Selected" and "Patch Selected".

Read button will read current values of list (Address/Value).

"Remove Not Found" button will read current values of list (Address/Value)
and will remove from list (Address/Value) the ones which
are not equal with "Value to search".

"Patch" button will patch all values of list (Address/Value)
with "New value".

Let me know about any bug or if you have any suggestion.
Source code (Visual C++ 6.0) released.

In MemoryHacker_fixed1:
- now "Remove Not Found" remove addresses for which read fails (probable due to memory being set free)
- Added "Suspend process", "Resume process" and "Get process state" in main dialog

[Trit0n]

Very good and simple tool.
I have never seen anything so simple.
Tip:
if you can't find all the processes in the list.
then use the tool “PowerRun”
(Runs the program as “TrustedInstaller or Nt Authority/system”)
https://www.sordum.org/9416/powerrun-v1-7-run-with-highest-privileges/
(Also applies to all other memory tools such as Winhex, 010Editor and many more)

[CodeCracker]

MemoryHacker_fixed2:
- Fixed buffer overflow posted by jackyjask
- Fixed conversion of MemoryBlock protection to string
- in "Inspect Memory" dialog added "Split string len"; and also added vertical scroll

[yoza]

Awesome.. as always !

[Mavrick]

Originally Posted by yoza

Awesome.. as always !

A thank you post from a mod. What irony!

[CodeCracker]

MemoryHacker_fixed4.rar:
- Fixed signed/unsigned mismatch, from now if search value start with '+' or '-' char it will considered signed else unsigned.
src&exe attached.

[CodeCracker]

MemoryHacker_fixed5:
- Fixed crush while pressing Esc key on dialogs.

[CodeCracker]

Here is MemoryHacker64: ported MemoryHacker to 64 bits.
Source code Visual Studio Community 2017 included.
Download link:
https://workupload.com/file/pLkj4dWe9hX
Currently is beta. Still needs testings; in special testing if write function works ok.

[CodeCracker]

MemoryHacker_fixed6: 32 bits and MemoryHacker 64 bit released as final (non beta):
- bug fix Replace VirtualProtect with VirtualProtectEx
now patches of non Writable access should work fine.

[CodeCracker]

I know I said it is the final version, but actually there was a bug on Memory Hack ->"Copy Selected" - it causes program to crush.

[Ibrahim_Mihai]

Still crashes when trying to dump on Windows 11

[CodeCracker]

Originally Posted by Ibrahim_Mihai

Still crashes when trying to dump on Windows 11

What do you mean by "when trying to dump", there is nothing like dump inside this program, can you explain one by one the steps you taken?

[CodeCracker]

New:
There was a bug on Memory Hack ->"Copy Selected" - it causes program to crush. The bug was fixed now for 32 bits version.

[Shub-Nigurrath]

I found this relatively old tool quite nice and handy for quick tasks, so I decided to give it a modern twist. I moved it to Win11, fixed several memory bugs, improved the code here and there and added a couple of handy features (like hex view on search matches).

Distro with changelog attached

best
Shub

[CodeCracker]

Nice @Shub-Nigurrath really improvements, many thanks.
Do you have any idea why MemoryHacker_Shub-fork.zip\x32\MemoryHacker.exe crushes sometimes ? May be one of my old bug.
"Inspect Memory" is really great, it will be great if we can switch from ASCII view to UNICODE view, plus it will also great if we can patch memory in both hex view mode and ASCII/UNICODE mode.
The last thing I was working at this program was on Patch (x64 version), for some reasons VirtualProtectExA returns GetLastError 87 on some addresses; I am searching 123 dword decimal and patch addresses of Winrar 64 bits.
It will be also great if I could add Dll Module Names on Memory Block.