Cheat Engine

[dnsi0]

I tryed to create a loop like this:
for i=&H00400000 to &H7FFFFFFF
next i

and echoed the results and it processes toooooooooooo slow... So I tryed it in delphi and it was even slower O.o So how do you scan for aobs?

[Overload]

Are you honestly trying to do this in VB? Do it in C. Its a lot easier.

[Dark Byte]

do NOT output it to the screen. the display as slow as hell. Just keep it internal (And don't do any memory allocations during the scan, so no adding items to a dynamic list)

[Overload]

Just iterate through the range and add the ones you want to an array.

[samuri25404]

Dump all the pages of a process, create a collection of the readable ones, then read the regions each as separate blocks of memory, one RPM per region, then iterate through the bytes in local memory as your program requires.

[nog_lorp]

Use the KPM algorithm, that will speed up the search significantly.
(for longer patterns)

[dnsi0]

[pkedpker]

only output when you found something.. (and thats still risky because if you are looking for zeros.. there might be a million zeros in memory so you will find a million zeros aka 1 million outputs printed or added to list aka SLOW)

outputting every line from
0x00400000 to 0x7FFFFFFF would be slow in all languages.

thats 130,023,423 lines to print.

also in VB6 i assume you are using you could use the Step function

for i=&H00400000 to &H7FFFFFFF Step NUMBEROFBYTES
next i

it would skip X of NUMBEROFBYTES..

say you scan for DWORDS do Step 4.. it will skip by 4's of bytes aka DWORDS

skipping it by 4's would drop the output printing from 130 million to only 32 million lines lol.. but yah.. if you want to scan for like a memory string of 20 characters do Step 20 etc... it will be faster the higher the stepping is..

Also if you want to update a counter of how much it scanned do it like this

[dnsi0]

[nog_lorp]

Step will miss values. If your data is not aligned on a 4 byte value from 0x00400000 you will skip the actual values. This will be especially bad for strings and byte arrays.

For most numeric values it should be safe to assume alignment, but with strings and byte arrays use KMP like I said - that will skip the most bytes you can possibly safely skip.

[Dark Byte]

also, if your cpu has sse4 you could make use of the new string scan instructions

[pkedpker]

[nog_lorp]

It can miss value no matter how you use it, if the values are not aligned in memory to the boundary you are aligning to. For example, say you are scanning with Step 4:
0x00400000 = 01234567
0x00400004 = 89ABCDEF

The memory looks like this:
0x00400000:
[67 45 23 01][EF CD AB 89]

You just missed
0x00402002 = CDEF0123

Because you broke it up in the middle.

Also, KMP is much more complicated then you seem to think, read about it on Wikipedia.

[pkedpker]

yah i think i know what u mean..

you mean like

[00 11 22 33][44 55 66 77 88]

and you scan for [11 22 33 44]

[00 [11 22 33 44] 55 66 77 88]




then it will not find it because it skipped the first 4.. because it started with 00.. that seems possible

a solution is still kinda possible with buffering the old data and processing it with new data but yah its not worth it.

[samuri25404]