 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
LunaRebirth Newbie cheater
Reputation: 0
Joined: 05 Sep 2013 Posts: 20
|
Posted: Wed Sep 18, 2013 12:15 am Post subject: Speeding up a search process - C++? |
|
|
So... I ended up not being able to find out how to find the static address of memory in a game.
So I ended up making a Console app which will search for each value separately, then respectively change them as I please.
To loop through each variable, I decided to make a loop in which the Hex value to scan for starts at 0x00000000 and ends at 0xFFFFFFFF.
This works. However, Incredibly slowely.
Since there are over thousands of variables from 0x00000000 to 0xFFFFFFFF, it takes thousands of frames to search each and every variable.
So I'm trying something like Cheat Engine, Where you search a number; And it pops up. Only difference is, it auto-changes the variable.
So if I were to want to change any variable of 15 to 0, It would search through all addresses for the number "15" and changes it to "0".
This currently works, but at a SUPER SLOW pase... Which I want to speed up.
In overall terms, I want it to scan as fast (Or faster) as Cheat Engine, but auto-change the variables I want so I don't have to.
How can I speed it up like this???
Thanks!
|
|
| Back to top |
|
 |
TsTg Master Cheater
Reputation: 5
Joined: 12 Dec 2012 Posts: 340 Location: Somewhere....
|
Posted: Wed Sep 18, 2013 8:58 am Post subject: |
|
|
| You can do multiple threads, each thread scans a region of the memory (you divide the regions as you like).
|
|
| Back to top |
|
 |
LunaRebirth Newbie cheater
Reputation: 0
Joined: 05 Sep 2013 Posts: 20
|
Posted: Wed Sep 18, 2013 12:22 pm Post subject: |
|
|
| TsTg wrote: | | You can do multiple threads, each thread scans a region of the memory (you divide the regions as you like). |
how would i do this?
I found this site. Is this what i need to use?
The replies. Or am i off on my research??? Please, if possible, direct me in the right spot. )) thanks!
Site link:
stackoverflow(dot)com/questions/266168/simple-example-of-threading-in-c
|
|
| Back to top |
|
 |
LunaRebirth Newbie cheater
Reputation: 0
Joined: 05 Sep 2013 Posts: 20
|
Posted: Wed Sep 18, 2013 9:08 pm Post subject: |
|
|
I found some usefull information on threading. But even with this,
How do I set it up to speed this search process, anyways???
I'm wanting to find every value from 0x00000000 to 0xFFFFFFFF which could take several THOUSANDS of frames. Resulting in actually getting from 0x00000000 to 0xFFFFFFFF within hours.
How does cheat engine find these variables so quickly??
I can't understand the process of how that works.
I made each frame add 0x00000001 to 0x00000000, and each frame; It reads the process for the address's value. Again, this works, but would take hours to fully finish.
I just don't understand how Cheat Engine does this.
I'm trying to do this for this reason;
Making a program to search for any 'double' value with 15, and make it 0 automatically on startup. Cheat Engine does not do that, and this would be very simple for me to do rather than going through many settings to set up.
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Thu Sep 19, 2013 12:50 am Post subject: |
|
|
| LunaRebirth wrote: | | I'm wanting to find every value from 0x00000000 to 0xFFFFFFFF which could take several THOUSANDS of frames. | More like 4,2 billion actually.
| LunaRebirth wrote: | | I made each frame add 0x00000001 to 0x00000000, and each frame; It reads the process for the address's value. Again, this works, but would take hours to fully finish. |
1-ReadProcessMemory is slow in itself, so you'd better read a bing chunk of memory (like 0x1000 bytes or more) in one go and parse in in your own memory space.
2-Unless your double belongs to a system dll, you can reduce your scanning range to 0 to 0x7FFFFFFF, memory above that is reserved for system stuff (unless you have a special windows xp that allows 3Gb of ram per process... Not sure what it became on win 7).
3-A program's memory is like cheese: full of holes, actually it's more like a desert with bits of allocated ram here and there. Each of those "bits of allocated ram" is called a memory region, and each region is made of one or several contiguous pages. The default size of a page is 0x1000 bytes (it can be configured otherwise but I've never seen a program change this setting). Moreover pages are always allocated at an address that is a multiple of the page size, That means that a page (and thus a region) can only begin at an address like for example 0x400000, but nowhere between 0x400001 to 0x400FFF.
Moreover access rights like writable/readable/executable apply to a whole region. That means that if there is no readable memory at 0x11111000, then there is no readable memory until at least 0x11112000.
4-In modern programs, variables (doubled, int, floats, first char of a string...) tend to be allocated at an address that is a multiple of 4 (we say "32 bit aligned") so that cpu can read them in one go (I heard their read operations are always 32 bit aligned...) that means that you don't need to scan addresses that end by 1, 2, or 3. <- What I just said here is called the "fast scan" option in cheat engine.
So what can you do with that knowledge? Use VirtualQuery to get information about a region at ScannedAddress.
-If this region is readable, ReadProcMem it entirely in one go, then scan it in your own memory space with a stupid for loop that proceeds by steps of 4 bytes, and if you find what you want, WriteProcMem 8 bytes in the target (not in your own memory space!).
-If it's not readable or not allocated or once you're done with scanning this region, increase ScannedAddress by the size reported by VirtualQuery, which should be a multiple of 0x1000.
-...Or if you want to go the lazy way, don't bother with VirtualQuery and just increase ScannedAddress by 0x1000 when ReadProcMem reports a failure.
That should make your scans a lot faster.
BTW: if you need more help, think about the forum search feature, you're far from being the first to have speed issues with an homemade scanner.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
 |
LunaRebirth Newbie cheater
Reputation: 0
Joined: 05 Sep 2013 Posts: 20
|
Posted: Thu Sep 19, 2013 8:40 am Post subject: |
|
|
I tried looking it up on google. But found no help.
Thank you so much for that awesome concept.
So to do this "the lazy way" (only because I'm not familiar with VirtualQuery), I'd need to search doubles for...
1. a multiple of 4
2. If no readable memory found, skip 1000 (no readable memory on 0x00000250, go to 0x00001250)
3. Start at 1000, end at 7FFFFFFF
Thank you so much.
I have yet to test this out, I will post my results!!
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Thu Sep 19, 2013 3:26 pm Post subject: |
|
|
| LunaRebirth wrote: | | If no readable memory found, skip 1000 | 0x1000, yes. | LunaRebirth wrote: | | no readable memory on 0x00000250, go to 0x00001250 | No, pages can only begin at an address that is a multiple of 0x1000, so no readable memory at 0x00000250, go to 0x00001000 (and nothing at 0x12345678 means go to 0x12346000).
On the the other hand, no readable memory at 0x00000250 means no readable memory at 0, so you have no reason to scan 0x250 if there is already nothing at 0.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
 |
LunaRebirth Newbie cheater
Reputation: 0
Joined: 05 Sep 2013 Posts: 20
|
Posted: Fri Sep 20, 2013 2:23 am Post subject: |
|
|
It's a ton faster than it was before. I didn't realize it was every thousandth and not SKIP a thousand
I fixed that.
My same issue is occurring; It's still a lot slower than I'd like it to be.
Am I asking too much here?
I'm trying different combinations.
It searches for addresses with a multiplicative of 4.
Once it's found that; If it is not readable, it goes to the nearest thousandth.
It then searches for what is a variable of "15" and changes it to "0".
The current process for this to change all addresses is, well...
Around 3 minutes probably? (There are over 300 results for variables of 15)
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 473
Joined: 09 May 2003 Posts: 25921 Location: The netherlands
|
Posted: Fri Sep 20, 2013 3:31 am Post subject: |
|
|
Never read less than 4096 bytes at a time with readprocessmemory
If possible, combine regions first so you have the biggest possible chunk
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|