Click to See Complete Forum and Search --> : Memory searcher?


Jake!
August 21st, 2005, 08:08 PM
Does anyone know of a program i can use to search through an applications memory for certain strings?
I've found a number of programs that'll search the memory, but only for numbers.
Or.. would the strings be in number format whilst in the memory? Ie. hex?

Edit: This is to obtain the memory addresses of those certain strings.

fleck
August 22nd, 2005, 07:15 AM
the strings' ll be shown in numbers. Do your tools have the option to show ascii values as the related letters? Look for such an option. If not, try to store the memory output and open it in an text editor which can show numbers or ascii letters.
Alex.

Jake!
August 22nd, 2005, 08:38 AM
The tools don't give an option to view ascii characters or anything a like, you simply search for a value and type (1,2,4,8 bytes, float, double) then it'll find all the memory addresses containing that value.
What format would the string be in exactly? hex, ascii, decimal?

fleck
August 22nd, 2005, 09:27 AM
That depends on your tool.
hex, ascii or dec are represented equal in memory.
The format you see is chosen by your tool. In general the values are shown in hex.

Alex.

Jake!
August 22nd, 2005, 10:12 AM
Oh, i forgot to say you can only search for values.. so i cannot search for hex, due to the letters.. so if i wanted to search for a number value of the word "hello" what would i search for?

MrViggy
August 22nd, 2005, 04:47 PM
Oh, i forgot to say you can only search for values.. so i cannot search for hex, due to the letters.. so if i wanted to search for a number value of the word "hello" what would i search for?
Search for the pattern: 0x68-0x65-0x6c-0x6c-0x6f; or the ASCII codes for each letter. Of course, these codes will be different if the string is stored in wide format.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsintro7/html/_pluslang_ascii_character_codes_chart_1.asp

Viggy