I figured out last problem. I have two machines. A desktop with 512 Meg and a laptop with supposedly 256Meg. I beleive it is actually shy of 256Meg but larger than 128Meg. What happened is the program would determine that it was 128Meg and therefore would limit the seach to that amout when the 4K pages the program was looking for was outside 128Meg so it limited the search and the 4K pages were never found.

FindMemSize:

push eax
push edi
push esi
mov esi,08BC00000h
invlpg dword ptr
shr esi,14h
or esi,0C0300000h
mov eax,0F9C001E3h ; Test if 4Gig Physical Mem*
mov dword ptr ,eax
mov esi,08bd001e0h ; Up 1Meg from base
mov eax,055AA55AAh
mov dword ptr ,eax
nop
nop
mov eax,dword ptr
cmp eax,055AA55AAh
jnz try2Gig
mov eax,03E7h ; Set up number of 4Meg pages*
mov FoundMemSize,eax
pop esi
pop edi
pop eax
retn
try2Gig:
mov esi,08BC00000h
invlpg dword ptr
shr esi,14h
or esi,0C0300000h
mov eax,07CC001E3h ; Test if 2Gig Physical Mem*
mov dword ptr ,eax
mov esi,08bd001e0h ; Up 1Meg from base
mov eax,055AA55AAh
mov dword ptr ,eax
nop
nop
mov eax,dword ptr
cmp eax,055AA55AAh
jnz try1Gig
mov eax,01F3h ; Set up number of 4Meg pages*
mov FoundMemSize,eax
pop esi
pop edi
pop eax
retn
try1Gig:
mov esi,08BC00000h
invlpg dword ptr
shr esi,14h
or esi,0C0300000h
mov eax,03E4001E3h ; Test if 1Gig Physical Mem*
mov dword ptr ,eax
mov esi,08bd001e0h ; Up 1Meg from base
mov eax,055AA55AAh
mov dword ptr ,eax
nop
nop
mov eax,dword ptr
cmp eax,055AA55AAh
jnz try512Meg
mov eax,0F9h ; Set up number of 4Meg pages*
mov FoundMemSize,eax
pop esi
pop edi
pop eax
retn
try512Meg:
mov esi,08BC00000h
invlpg dword ptr
shr esi,14h
or esi,0C0300000h
mov eax,01F0001E3h ; Test if 512Meg Physical Mem*
mov dword ptr ,eax
mov esi,08bd001e0h ; Up 1Meg from base
mov eax,055AA55AAh
mov dword ptr ,eax
nop
nop
mov eax,dword ptr
cmp eax,055AA55AAh
jnz try256Meg
mov eax,07Ch ; Set up number of 4Meg pages*
mov FoundMemSize,eax
pop esi
pop edi
pop eax
retn
try256Meg:
mov esi,08BC00000h
invlpg dword ptr
shr esi,14h
or esi,0C0300000h
mov eax,0F4001E3h ; Test if 256Meg Physical Mem*
mov dword ptr ,eax
mov esi,08bd001e0h ; Up 1Meg from base
mov eax,055AA55AAh
mov dword ptr ,eax
nop
nop
mov eax,dword ptr
cmp eax,055AA55AAh
jnz try128Meg
mov eax,03Dh ; Set up number of 4Meg pages*
mov FoundMemSize,eax
pop esi
pop edi
pop eax
retn
try128Meg:
mov esi,08BC00000h
invlpg dword ptr
shr esi,14h
or esi,0C0300000h
mov eax,078001E3h ; Test if 128Meg Physical Mem*
mov dword ptr ,eax
mov esi,08bd001e0h ; Up 1Meg from base
mov eax,055AA55AAh
mov dword ptr ,eax
nop
nop
mov eax,dword ptr
cmp eax,055AA55AAh
jnz nothingMem
mov eax,03Dh ; Set up number of 4Meg pages*
mov FoundMemSize,eax
nothingMem:
pop esi
pop edi
pop eax
retn

If you look right above you will see I changed from a 1E to 3D for 128 Meg determination (these are number of 4Meg pages). Now the program will page fault for nonexisting memory but it is handled.
This was the final problem and you may run into this yourself if you have a non standard amount of memory like unstead of 512Meg you have 400Meg. Than you will need to edit this code yourself in the driver BAT file (code above). You may ask why didn't I just call all computers 4Gig memory? The reason is running through that many page faults takes some time.
At any rate the program once again will edit any physical memory and find search strings of other programs that you may edit. It has some I/O control. It reads and edits 4K at a time. It is not user freindly but if you read the instructions carefully and operate it a few times it will become second nature in operation and is an extremely useful tool for learning and debugging. The program would not be possible without the awesome work of our freind Four-F.
Posted on 2004-08-10 23:37:04 by mrgone
So here it is:


It's just been noted that when using search string command to search specific data out of memory I did not give it an out if the memory doesn't exist. Have to fix later. No time now. Better get back to regular job...lol
Posted on 2004-08-11 20:09:45 by mrgone