Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Speeding up a search process - C++?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
LunaRebirth
Newbie cheater
Reputation: 0

Joined: 05 Sep 2013
Posts: 20

PostPosted: Wed Sep 18, 2013 12:15 am    Post subject: Speeding up a search process - C++? Reply with quote

So... I ended up not being able to find out how to find the static address of memory in a game.
So I ended up making a Console app which will search for each value separately, then respectively change them as I please.

To loop through each variable, I decided to make a loop in which the Hex value to scan for starts at 0x00000000 and ends at 0xFFFFFFFF.
This works. However, Incredibly slowely.
Since there are over thousands of variables from 0x00000000 to 0xFFFFFFFF, it takes thousands of frames to search each and every variable.

So I'm trying something like Cheat Engine, Where you search a number; And it pops up. Only difference is, it auto-changes the variable.
So if I were to want to change any variable of 15 to 0, It would search through all addresses for the number "15" and changes it to "0".
This currently works, but at a SUPER SLOW pase... Which I want to speed up.

In overall terms, I want it to scan as fast (Or faster) as Cheat Engine, but auto-change the variables I want so I don't have to.

How can I speed it up like this???

Thanks!
Back to top
View user's profile Send private message
TsTg
Master Cheater
Reputation: 5

Joined: 12 Dec 2012
Posts: 340
Location: Somewhere....

PostPosted: Wed Sep 18, 2013 8:58 am    Post subject: Reply with quote

You can do multiple threads, each thread scans a region of the memory (you divide the regions as you like).
Back to top
View user's profile Send private message
LunaRebirth
Newbie cheater
Reputation: 0

Joined: 05 Sep 2013
Posts: 20

PostPosted: Wed Sep 18, 2013 12:22 pm    Post subject: Reply with quote

TsTg wrote:
You can do multiple threads, each thread scans a region of the memory (you divide the regions as you like).


Surprised how would i do this?
I found this site. Is this what i need to use?
The replies. Or am i off on my research??? Please, if possible, direct me in the right spot.Smile)) thanks!

Site link:
stackoverflow(dot)com/questions/266168/simple-example-of-threading-in-c
Back to top
View user's profile Send private message
LunaRebirth
Newbie cheater
Reputation: 0

Joined: 05 Sep 2013
Posts: 20

PostPosted: Wed Sep 18, 2013 9:08 pm    Post subject: Reply with quote

I found some usefull information on threading. But even with this,
How do I set it up to speed this search process, anyways???
I'm wanting to find every value from 0x00000000 to 0xFFFFFFFF which could take several THOUSANDS of frames. Resulting in actually getting from 0x00000000 to 0xFFFFFFFF within hours.

How does cheat engine find these variables so quickly??
I can't understand the process of how that works.

I made each frame add 0x00000001 to 0x00000000, and each frame; It reads the process for the address's value. Again, this works, but would take hours to fully finish.
I just don't understand how Cheat Engine does this.

I'm trying to do this for this reason;
Making a program to search for any 'double' value with 15, and make it 0 automatically on startup. Cheat Engine does not do that, and this would be very simple for me to do rather than going through many settings to set up.
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Thu Sep 19, 2013 12:50 am    Post subject: Reply with quote

LunaRebirth wrote:
I'm wanting to find every value from 0x00000000 to 0xFFFFFFFF which could take several THOUSANDS of frames.
More like 4,2 billion actually.

LunaRebirth wrote:
I made each frame add 0x00000001 to 0x00000000, and each frame; It reads the process for the address's value. Again, this works, but would take hours to fully finish.

1-ReadProcessMemory is slow in itself, so you'd better read a bing chunk of memory (like 0x1000 bytes or more) in one go and parse in in your own memory space.
2-Unless your double belongs to a system dll, you can reduce your scanning range to 0 to 0x7FFFFFFF, memory above that is reserved for system stuff (unless you have a special windows xp that allows 3Gb of ram per process... Not sure what it became on win 7).
3-A program's memory is like cheese: full of holes, actually it's more like a desert with bits of allocated ram here and there. Each of those "bits of allocated ram" is called a memory region, and each region is made of one or several contiguous pages. The default size of a page is 0x1000 bytes (it can be configured otherwise but I've never seen a program change this setting). Moreover pages are always allocated at an address that is a multiple of the page size, That means that a page (and thus a region) can only begin at an address like for example 0x400000, but nowhere between 0x400001 to 0x400FFF.
Moreover access rights like writable/readable/executable apply to a whole region. That means that if there is no readable memory at 0x11111000, then there is no readable memory until at least 0x11112000.
4-In modern programs, variables (doubled, int, floats, first char of a string...) tend to be allocated at an address that is a multiple of 4 (we say "32 bit aligned") so that cpu can read them in one go (I heard their read operations are always 32 bit aligned...) that means that you don't need to scan addresses that end by 1, 2, or 3. <- What I just said here is called the "fast scan" option in cheat engine.


So what can you do with that knowledge? Use VirtualQuery to get information about a region at ScannedAddress.
-If this region is readable, ReadProcMem it entirely in one go, then scan it in your own memory space with a stupid for loop that proceeds by steps of 4 bytes, and if you find what you want, WriteProcMem 8 bytes in the target (not in your own memory space!).
-If it's not readable or not allocated or once you're done with scanning this region, increase ScannedAddress by the size reported by VirtualQuery, which should be a multiple of 0x1000.
-...Or if you want to go the lazy way, don't bother with VirtualQuery and just increase ScannedAddress by 0x1000 when ReadProcMem reports a failure.

That should make your scans a lot faster.

BTW: if you need more help, think about the forum search feature, you're far from being the first to have speed issues with an homemade scanner.

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
LunaRebirth
Newbie cheater
Reputation: 0

Joined: 05 Sep 2013
Posts: 20

PostPosted: Thu Sep 19, 2013 8:40 am    Post subject: Reply with quote

I tried looking it up on google. But found no help.

Thank you so much for that awesome concept.Smile
So to do this "the lazy way" (only because I'm not familiar with VirtualQuery), I'd need to search doubles for...
1. a multiple of 4
2. If no readable memory found, skip 1000 (no readable memory on 0x00000250, go to 0x00001250)
3. Start at 1000, end at 7FFFFFFF

Thank you so much.Smile
I have yet to test this out, I will post my results!!
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Thu Sep 19, 2013 3:26 pm    Post subject: Reply with quote

LunaRebirth wrote:
If no readable memory found, skip 1000
0x1000, yes.
LunaRebirth wrote:
no readable memory on 0x00000250, go to 0x00001250
No, pages can only begin at an address that is a multiple of 0x1000, so no readable memory at 0x00000250, go to 0x00001000 (and nothing at 0x12345678 means go to 0x12346000).
On the the other hand, no readable memory at 0x00000250 means no readable memory at 0, so you have no reason to scan 0x250 if there is already nothing at 0.

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
LunaRebirth
Newbie cheater
Reputation: 0

Joined: 05 Sep 2013
Posts: 20

PostPosted: Fri Sep 20, 2013 2:23 am    Post subject: Reply with quote

It's a ton faster than it was before. I didn't realize it was every thousandth and not SKIP a thousand Razz
I fixed that.

My same issue is occurring; It's still a lot slower than I'd like it to be.
Am I asking too much here? Surprised
I'm trying different combinations.
It searches for addresses with a multiplicative of 4.
Once it's found that; If it is not readable, it goes to the nearest thousandth.
It then searches for what is a variable of "15" and changes it to "0".

The current process for this to change all addresses is, well...
Around 3 minutes probably? (There are over 300 results for variables of 15)
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25921
Location: The netherlands

PostPosted: Fri Sep 20, 2013 3:31 am    Post subject: Reply with quote

Never read less than 4096 bytes at a time with readprocessmemory
If possible, combine regions first so you have the biggest possible chunk

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites