Cheat Engine

[Outshynd]

Let me start off by saying that the reason I am posting this question here is that CE's search function seems to be the quickest out of any memory editor/searcher I've ever used. Tsearch is fast, artmoney is fast, CE seems faster. I'd like to try and take advantage of whatever method of memory searching is used here.

That being said, here's the background information that may or may not be relevant. I'm currently writing a program in Visual Basic 6.0 for World of Warcraft that reads a value that is at a static address and then searches through the rest of the client for other occurances of said value. The value is a Float. It generally can be found at anywhere between 4 and 10 addresses within the client, dependant on how many times you've relogged, current state of events, etc. The certain address that I need to find, however, always ends in 938. For instance, if I were to search for this value and come across two addresses -- 16374938 and 16374666 -- I would instantly know that 16374938 is the address of the value I need to change.

Now then, I've been using ReadProcessMemory to run through a certain range of the client in 1000 byte steps, and this is extremely inefficient (didn't need to tell you that, I know). I start at 10000938 and step +1000 and re-search, so I hit every address that ends in 938. As it stands, it takes about two minutes to find the correct value. CE finds 7 occurances of the value in about 15 seconds over a wider range. I would be eternallly indebted if anyone could give me a few tips as to how one would go about optimizing a ReadProcessMemory function for my needs.

I'm not sure if this is the correct place to post this, so please accept my apologies if it is not. If you've gotten this far, I'd like to thank you for taking the time to read this and I'd like to thank you in advance for any thought put into a response / hopeful solution :)

-Shynd

[Dark Byte]

First get the regions of memory that are readable by using VirtualQueryEx and look for commited memory. (you might want to skip mapped memory though because thats usually only pictures and movies that dont contain anything usefull anyhow...)

Windows handles it's memory in pages. The size of one page is 4096 bytes. if the first byte of a page can be read, the last byte of that page can also be read.
Try to minimalize the number of calls you make to ReadProcessMemory. Each call has a small overhead. So instead of calling ReadProcessMemory 500000 call it 2500 times (or something, by combining memory regions that are linked)
By default Cheat Engine splits up the regions it scans into blocks of 512kb (if the region is bigger than that) so it prevent resource starvation from the os.

Also, decrease file access as much as possible. If you have to choose about allocating memory or using a temp file to store your data, choose allocating memory. If there's not enough ram windows will put it in the swapfile itself anyhow. (Cheat Engine does use a tempfile to store results of a scan to a tempfile during the scan, but only after finding 512000 results)

And last but not least, when scanning the data you've read use efficient code. every cycle counts in those loops. (use a pointer that points to the start of the buffer, and then increase the pointer and check the value of the pointer)