Cheat Engine

peter4d5 · Cheater Reputation: 0 Joined: 21 Dec 2010 Posts: 37

I've tried to code aobscan.dll(very fast...i like it ), but problem is that when dll read at itself memory, error...
I think that if i can skip reading dll's memoty, problem solved..
How do dll can get itself base address and size for skiping when reading there?

Thank you.

atom0s · Posted: Thu Feb 09, 2012 7:07 am Post subject:

You can use VirtualQuery/VirtualQueryEx to read the memory regions. You can also use GetModuleHandle to obtain the handle of your module and skip it based on that.

You can dump all the modules with:
- CreateToolhelp32Snapshot
- Module32First / Module32Next

or
PSAPI functions.

Dark Byte · Posted: Thu Feb 09, 2012 7:14 am Post subject:

Also don't forget about memory you may have allocated yourself, (especially if you combine it with a gui)
example:
Adding a entry will allocate new memory, which will get scanned, which contains one or more values you're going to add, which allocates new memory which gets scanned, which contains one or more values you're goin to add, .... till you run out of memory and crash

peter4d5 · Cheater Reputation: 0 Joined: 21 Dec 2010 Posts: 37

Atm, i can find my dll's base address and size, but not really get about Dark Byte's recommendation.
Would you please give me more detail (or some short code) and how to prevent from that ?.

Because one of my little projects(hobby) is Pointer Searching tool (use VirtualQueryEx - with remote process),
if data more than 10,000x4k(Page?), it take a long time, that why i want to do it as dll.

Dark Byte · Posted: Fri Feb 10, 2012 7:46 pm Post subject:

Keep your addresslist in a block of memory you allocate and do not resize it during scans (so don't use a gui during scans)

Then let the scan routine know not to scan that block of memory, and when it is full write the results to disk and reuse that same block again

Also, for a level 1(2 max) pointerscanner a dll is a suitable solution, but if you want speed I do recommend a remote process so you don't have to share the 1.8GB memory block with the game and your pointerdata

Fyi: The part where ce's pointerscan fills a progressbar is the only part where it's reading the process memory (and filing the results in the appropriate places) , after that it's lookup only

peter4d5 · Cheater Reputation: 0 Joined: 21 Dec 2010 Posts: 37

Sorry, time difference between us ~12 hrs and english still be my problem, i can't login all time and have to search many topics
(all about game hacking). Now, i have some idea for new topic.

( I just read stuff that i google about Anti-Alt Tab and see that CE already have this feature, ....that why i love CE..)
thank you