Page 1 of 1

Unloaded Strings

Posted: 12 Jan 2018 23:56
by Controversed
It's like the function "Unloaded Modules" but for strings of the process (memory). It'll be so cool !
I hope to find this function / plugin one day!

Re: Unloaded Strings

Posted: 16 Jan 2018 05:01
by xtal256
What would it mean for a string to be "unloaded"? Are you suggesting that Process Hacker remember strings it has detected even after they no longer exist in memory (either because they have been deleted or modified)?

Just out of curiosity, where do I find this "Unloaded Modules" feature?

Re: Unloaded Strings

Posted: 16 Jan 2018 17:17
by Controversed
There are strings that come off all by themselves in the process, I think it's to avoid an overload memory. So I wonder if it's possible to retrieve them with a function "see strings history" or "from the beginning," and for the function "unloaded modules", it's in "Miscellaneous".

Re: Unloaded Strings

Posted: 25 Jan 2018 00:08
by xtal256
I don't understand that expression, "come off all by themselves". What programming language are you talking about? Do you mean garbage collection?

Process Hacker already has a "String Search" feature, which scans the memory of a process looking for regions that look like strings (i.e. bytes in the ASCII range and zero terminated). Perhaps this is what you are looking for.

Re: Unloaded Strings

Posted: 25 Jan 2018 10:50
by TETYYS
There are strings that come off all by themselves in the process, I think it's to avoid an overload memory. So I wonder if it's possible to retrieve them with a function "see strings history" or "from the beginning," and for the function "unloaded modules", it's in "Miscellaneous".
This would require tracing every free() call to any memory block and storing them somewhere which would slow down the target program and hog resources. I think this is unviable