| View previous topic :: View next topic |
| Author |
Message |
b6ooy
Grandmaster Cheater
![]() Reputation: 0
Joined: 21 Sep 2006
Posts: 653
|
 Posted: Mon Dec 15, 2008 6:54 am Post subject: What region types does CE scans ? |
 |
|
a normal scan with CE with or without Scan read-only memory gives me less results than my memory scanner .
I am using VirtualQueryEx to identify the memory region before attempting to scan so it does not crash .
first i used this condition before scanning :
| Code: | | if( dwState == MEM_COMMIT && dwProtect != PAGE_READONLY && dwProtect != PAGE_NOACCESS && dwType != MEM_PRIVATE) |
and the results always more than what CE gets , I added some of the addresses thet CE didn't get and tryed to change the value but it canot be frozen or changed .
then i though why doing all this , so tried :
| Code: | | if( dwProtect == PAGE_READWRITE ) |
and it still give more results than CE and those useless addresses that doesn't change , I want to get rid off them but how ?
my question is what type/memory protection region does CE scans .
|
|
| Back to top |
|
 |
Noz3001
I'm a spammer
 Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Mon Dec 15, 2008 7:18 am Post subject: |
|
|
| Do you read every byte?
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 475
Joined: 09 May 2003
Posts: 26008
Location: The netherlands
|
| Posted: Mon Dec 15, 2008 7:42 am Post subject: |
|
|
ce scans mem_private and mem_image, but does NOT scan mem_mapped (at least not by default, can be changed in settings, but yes, as you noticed, they can be quite useless)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
b6ooy
Grandmaster Cheater
![]() Reputation: 0
Joined: 21 Sep 2006
Posts: 653
|
| Posted: Mon Dec 15, 2008 8:17 am Post subject: |
|
|
| noz3001 wrote: | | Do you read every byte? |
read every byte from a given region , default 400000-7FFFFFFF .
the scan is fast when the value is unique but if value is 0 or 1 it takes very long time because it store them on the hardisk and read them again for the next scan .
| Dark Byte wrote: | | ce scans mem_private and mem_image, but does NOT scan mem_mapped (at least not by default, can be changed in settings, but yes, as you noticed, they can be quite useless) |
Atleast it helped 
but there still a 13:10 different there are some mem_private that ce doesn't scan 
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 475
Joined: 09 May 2003
Posts: 26008
Location: The netherlands
|
| Posted: Mon Dec 15, 2008 8:25 am Post subject: |
|
|
if readonly is disabled it will not scan regions marked as PAGE_EXECUTE_READ not just PAGE_READONLY
also, fastscan on or off ?
And besides that, make sure you have a single core cpu, else get the 5.4.4 beta of ce
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping
Last edited by Dark Byte on Mon Dec 15, 2008 8:29 am; edited 1 time in total |
|
| Back to top |
|
|
b6ooy
Grandmaster Cheater
![]() Reputation: 0
Joined: 21 Sep 2006
Posts: 653
|
| Posted: Mon Dec 15, 2008 8:29 am Post subject: |
|
|
| Dark Byte wrote: | if readonly is disabled it will not scan regions marked as PAGE_EXECUTE_READ not just PAGE_READONLY
And besides that, make sure you have a single core cpu, else get the 5.4.4 beta of ce |
got the same numbers of found but why this happens , is it normal ?
found same numbers and displayed 4 of the addresses twice and the onse starts with 1c got ignores .
Last edited by b6ooy on Mon Dec 15, 2008 8:31 am; edited 1 time in total |
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 475
Joined: 09 May 2003
Posts: 26008
Location: The netherlands
|
| Posted: Mon Dec 15, 2008 8:30 am Post subject: |
|
|
looks like a dualcore or hyperthreading cpu. 5.4 original has a slight bug with splitting up the workload and causes some overlap and other unpredictable crap
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
