Hack32 v1

General

Hack32 has not been intended to be used by lamers or such, so this manual is brief. This program can search, edit and ôfreezeö certain values in virtual memory of any currently running process (to a certain extent). This version searches for integral and floating-point types of data, on the basis of exact match.

In this manual I will use the following terms relating to Hack32Æs main window:

The leftmost list box in the main window is the FOUND ADDRESSES LIST; it contains newly found addresses matching the search pattern.
The rightmost list view is the ITEMS LIST (or TABLE OF ITEMS) containing items chosen for examination, editing or freezing. Each item consists of its description, the address it represents, and the value at that address.

Buttons

Process
Select a process to search in. You will be shown a tree of all running processes along with their non-child windowsÆ titles (if any). If a new process is selected, then all internal data structures are reset and only a new search is permitted.

New
Perform a new search in virtual memory of target process, searching for bytes and floats concurrently.

Next
Each next search uses the addresses found by a previous search, reducing the found addresses database.

Load
Loads previously saved table of items. If an item has been frozen at save time, its value is restored also, and the item comes to the table still frozen to the saved value.

Save
Saves the current table of items to a .H32 file including descriptions, addresses, items' states, and (for frozen items) the values.

Cancel
Only available during a search. Cancels the running search but preserves the amount of addresses found so far.

> (add)
Adds the selected addresses from the addresses list to the items list where they can be examined, edited and frozen.

Status bar

1st part: 'Busy' when a process is selected and running, and at least one item is present in the items list. In other cases 'Idle'. Target processÆ presence detection works only when æBusyÆ.

2nd part: During a new search, shows the current address being scanned. After completion of every search, the number of found addresses is shown here.

3rd part: Executable name of selected process.

4th part: After a process is selected, this will be the processÆ searchable memory size.

Window menu (Alt+Space)

Refresh rate
The interval between each memory refresh. Specifies how frequently the items in the list view are updated and frozen. Defaults to 250 milliseconds.

List box max items
Maximum capacity of the found addresses list. It is updated every time a search (new or next) is completed. Defaults to 100 items.

These values are stored in the system's registry and fetched every time Hack32 starts. The changed values activate immediately.

The items list

50 items can be stored in it. The items can be deleted by selecting them (multiple selection works too) and pressing 'Del'. While the list has keyboard focus, you can manually introduce a new address to the table by pressing 'Ins'. If an address is highlighted, you can press Alt+1 to Alt+8 to enter an address which resides at (address highlighted + x), where x belongs to 1..8.

The items' sorting works for the 'Address' column only. The value displayed in the 'Value' column for each item can be either 1(integer) or 4(float) bytes long; if you need to freeze an integer value to a value>255, you should manually enter the next address (higher byte) and freeze it also. To determine whether the value found is a byte or a float, try changing the value of an item to a value>255. If it is displayed in full, itÆs a float, else only the lowest byte of the entered value will be shown. Note that, for a byte address, if you enter a value which is more than 1 byte long, it will be written to the memory in full.

Not-so-obvious things

You can edit the items' labels by right clicking on them / pressing F2.
A value at an address can be edited by left clicking on it / pressing Enter.
Freeze an address to its present value by checking the check box next to the items' label by clicking on it / pressing space.
Alt+1 .. Alt+8 introduces an address which stands +1..+8 bytes off the selected one.
By pressing Ctrl+Alt+Z within any non-console program, Hack32 window can be put to the foreground.
It is not recommended for labels to be more than 32 chars long (they will be truncated when saved/loaded).
The progress bar will work properly only if the number of found items is less than 512K after a search.
Hack32 performs its searches in another thread with higher priority, so other processes may seem to run slower.
Generally, saved tables work fine with Win32 programs. For non-Win32 ones and some other proggies, however, the tables might not be valid, so rescanning might be required.
Although you can enter an integer value of up to 4GB as a search pattern, the program searches and shows the lowest byte only (quick, simple and reliable method). Floating-point data types are shown and searched for in full. However, change of value of a byte-address to a value greater than 255 writes more than one byte to consequtive addresses.
It is a rather bad idea to search for zeros, 256Æs, 768Æs, and so on (values with lowest byte zero) in the new search, because there is a whole bunch of zeros in memory, and the system will run out of resources trying to allocate enough memory for Hack32Æs database. You can, however, safely search for 0Æs in consequtive searches.
When entering a hexadecimal value, precede it with æ0xÆ as if in C++. Any invalid characters will be ignored, thus æ0xtybva4-/?Æ will be treated as æBA4Æ hex, and æ0Xt5ybva4-/?Æ as æ54Æ decimal, because of the uppercase æ0XÆ.
Supported operating systems: Win95/98, WinNT4.0 and Win2K (for process objects with security attributes allowing operations within them only).

Considering the present inability to operate certain functions in Hack32Æs table of items with keyboard only, the proggy can not be fuckinÆ considered ôdesigned for Windowsö after all J à