A separate executable (e.g., Unlock_and_converter_MMC_Image_S7.exe ) would then scan the image file for the specific memory address where the password hash was stored and attempt to display the original characters.