Cheat Engine

[oib111]

I have a question about the ReadProcessMemory parameters. More specifically, nSize. I understand it's the size in bytes. But I don't understand how I would know that. I mean, if I had something like...

[HalfPrime]

the size os how many bytes you want to read. If you wanted to read an int, you'd do sizeof(int) which is 4.

If you wanted to take a chunk:
lpBuffer[9000]
ReadProcessMemory(hProcess, BaseAddress, lpBuffer, 9000, NULL);

EDIT:
or do you mean you don't know the size of the memory the program has allocated for itself?

[atom0s]

The size param is for how many bytes you want it to read. The buffer that is allocated needs to be the same size or bigger or you will get errors during the read. You can also check if the read was successful or if it read what was needed with the lpNumberOfBytesRead param return.

For example, if you wanted to read 5000 addresses as bytes you could do:

[tombana]

Still you have to make sure you're reading valid memory.
You can't just fill in 0 for the start adress and 0x7fffffff for size to read the complete memory, because there will be parts inbetween which aren't allocated.

[nwongfeiying]

I'm proud of myself for understanding most of it. But how is the memory viewer of the Cheat Engine created? Memory dump?

[atom0s]

Think CE dumps by region and updates based on the region that is currently visible in the memory viewer. Can't really say for sure though since I don't know Delphi enough to look through the code to find the exact code that does this.

[rapion124]

If you look on MSDN's documentation for ReadProcessMemory, it says that it will fail if not all of the memory is readable. As a result, you must use VirtualQuery(Ex) to enumerate all the memory regions that are readable.

[tombana]