Memory Operations
Commit, decommit, and free virtual memory regions with hex dump viewing and memory dump export capabilities.
Memory Region Enumeration
The Memory window displays all virtual memory regions via VirtualQueryEx:
- • Base Address — Starting address of the region
- • Allocation Base — Base address of the allocation
- • Region Size — Size in bytes
- • State — Commit, Reserve, or Free
- • Type — Private, Mapped, or Image
- • Protection — Memory protection flags (R/W/X combinations)
- • Module — Associated module name for MEM_IMAGE regions
Available Operations
Commit Memory
Commit reserved memory regions to make them usable. Uses VirtualAllocExwith MEM_COMMIT.
Decommit Memory
Decommit committed memory regions, returning them to reserved state. Uses VirtualFreeEx with MEM_DECOMMIT.
Free Memory
Free entire allocations, releasing the virtual address space. Uses VirtualFreeEx with MEM_RELEASE.
Hex Dump Viewer
View the raw bytes of any committed memory region:
- • Paginated display (4KB pages)
- • Hex column with byte values
- • ASCII column showing printable characters
- • Navigation controls for large regions
Memory Dump Export
Export any committed memory region to a .bin file:
- • Available from action button in memory table
- • Available from context menu
- • Available from hex dump view
- • Native save dialog for file location
Functions
| Function | File | Description |
|---|---|---|
| commit_memory() | memory.rs | Commit reserved memory |
| decommit_memory() | memory.rs | Decommit committed memory |
| free_memory() | memory.rs | Free entire allocation |
Usage
- Right-click a process → Inspect → Memory
- Browse memory regions in the table
- Use filter to search by address, state, type, or module
- Click a region to view hex dump
- Use context menu or action buttons for operations