Hex Editor - Binary File Editing Software for Windows
To open a process memory, execute the File » Open » Open Process… command. The Open Process dialog appears:
This resizable window lists all running processes on the left. It is recommended to run the Hex Editor Neo as an elevated user with Administrative rights to be able to view and edit process memory. In some operating system, there are always several processes that cannot be edited even by a most privileged user. This limitation is dictated by the operating system and is not related to Hex Editor Neo.
To open the whole process virtual memory, double click the process in the list.
If you need only a subset of process' virtual memory, select it in the list. Hex Editor Neo will analyze the process' allocated and free memory blocks and provide you with a detailed list in the middle part of the Open Process window.
Process' memory blocks may be viewed as is (Blocks tab) or as a list of loaded modules (Modules tab). For each block, its starting address, size, type, state and access are provided. In addition, for blocks that are mapped to file system files, the full name of the file is provided.
The list may be sorted in ascending or descending order on every list's column.
Hex Editor Neo uses coloring to display the access state of every memory block. You can change colors used by the editor if you like by pressing the Set Colors… button.
All integers in this dialog may be displayed in decimal or hexadecimal, depending on the state of the "Display decimal values" switch.
The "Open as Read-Only" switch will prevent you from modifying the opened region.
If you run Hex Editor Neo on 64-bit operating system, you will see both 64-bit and 32-bit processes in the list. Hex Editor Neo is fully compatible with both process types and allows you to view and edit both process type's memory space.
There is a colored map on the right of the dialog. It displays essentially the same information as the memory block list in the middle, but draws each memory block in correct scale and also displays its location in process address space.
"Logarithmic scale" option switches the display mode for the memory map between the normal and logarithmic. In logarithmic scale you do not see proper block sizes anymore, but individual blocks are represented better. This switch is ON on 64-bit operating systems by default, as it is virtually impossible to see anything in normal scale with huge virtual memory space.
To open one or several memory blocks, select it (them) in the list and press the OK button. Double-clicking on the block opens this block (or module) only.
Note that you will not be able to select multiple blocks if you change the default list sorting order.