thanks for developing this charming tool ...
i am a rookie , and i tried to have an exercise ! but i can't finish it myself !
and i need your guide about it ...
briefly my purpose is that to find what is the address of a simple mspaint graphic on RAM ?
and these are my steps :
1: i opened "C:\WINDOWS\system32\mspaint.exe" for debug in MHS .
2: i assigned the value of 230 to R and G and B channels. and filled the canvas (32x32) with this color .
3: i searched for this value in the range 0x0..0x20000000 (my RAM is 512mb) .
4: i changed the color of canvas (32x32) to RGB=194 , by sub searching the founded address for value of 194 i found the location of graphic data at address 0x00EE0000 (attached image) . that contains 3072= 32x32x3 byes.
5: and then i searched for a pointer that points at address 0x00EE0000 , in range 0x0..0x20000000 , only one result found : 0x00CE63AC ---> 0x00EE0000
conclusion , this address is out of 0x01000000 + 0x00057000 (the area belongs to mspaint.exe) and even by searching for another pointer (nested) that point to this pointer (0x00CE63AC) i had no result ...
please disabuse me and show me the right way for doing of similar works like this ...
many regards ...