I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data).

Now , when i open the process Entire memory with in WinHex , i can easily search and find those sensitive data , but when i open each sub-module memory one by one , i can not find them !!

How this is possible ?

Is there any floating memory in each process which does not belong to process itself and it's sub-modules ?

Update : The strange thing is each time this data appear on a completely different offset !

I appreciate for your answer. Thank you.

  • What do you mean by submodules? The loaded DLLs? Yes, there is indeed memory that isn't typically part of modules. It's called heap and stack. And even inside the address range of modules you'll find cavities which can be (ab)used to store data. A technique that was at some point in fashion for VXers/malware authors.
    – 0xC0000022L
    Jun 23 '20 at 7:36
  • @0xC0000022L : Thank you for your answer , so it seems there's no way to have a fixed offset of that data in order to remove it , am i right ? Jun 23 '20 at 11:25
  • Generally correct. But that wasn't even part of your original question ...
    – 0xC0000022L
    Jun 23 '20 at 12:47

You can use VMMap by SysInternals to inspect the memory layout of the process and determine what exactly the mysterious memory is.

If it is heap memory, most likely there is a pointer to it somewhere in the process' data section, so you may be able to track it from there. Note that there can be multiple levels of indirections for a specific memory block. You may be able to use Cheat Engine to discover a pointer chain to the area of interest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.