Dual RAM Watcher

[AlaXul]

I've been using the RAM watcher feature to monitor DMA memory while debugging an applicaton. I have come to a point where the application is referencing two area's of memory in a procedure:

MOV DL,BYTE PTR SS:[ESP+EAX+20]
SUB DL,BYTE PTR DS:[EAX+927474]

It would be great to be able to monitor both the RAM area's in ESP+EAX+20 and EAX+927474 at the same time. Essentially have two RAM watcher windows side by side allowing to see the two sets of values and watch the debugger modify the values in runtime.

Keep up the awsome work, Cheers!

[L. Spiro]

For the time being, you can use the Hex Editor to watch both areas.

It is also in real-time, and you can have multiple views open.


L. Spiro

[AlaXul]

Awsome, I did not realize that the HEX editor was able to view process memory. This helps lots. But it would be nice to do this in RAM viewer because I was using the HEX | DEC comparision side by side feature. Also, in the HEX editor, I noticed that if I right click on the top legend, 123456789ABCDEF..., not data, but just above, it crashes MHS. Here is the error:

AppName: memhack.exe AppVer: 3.0.1.4 ModName: memhack.exe
ModVer: 3.0.1.4 Offset: 000a42d0

[L. Spiro]

Good bug to find.
I suspect this was introduced when I made it able to read the entire 4 gigabytes of process RAM (actually up to 17,179,869,184 gigabytes).
It will be easy to find and fix, however I won’t be available to release the fix until Monday.



I was using the HEX | DEC comparision side by side feature
Go to View/Base Options.
In the Current Layer, select the data type you wish to view.
The right side will be displayed as that type.


L. Spiro

[AlaXul]

Perfect, that solves the problem.. LoL, perhaps I should check these things myself before asking..hehe.