Cheat Engine

[AylinCE]

I've added a lot of explanation so let's clarify something before you start reading:

This module consists of two separate parts (AobEngine.dll, aobEngine.lua) and works with the options given below.

The purpose of the module is to allow scans that freeze the CE or Trainer Form (GUI) to be performed outside the form, aiming to make using the Trainer easier and faster.

(I remember times when the Trainer froze during an AOB scan that found 30,000 results...)



🔍 Native C++ AOB Engine: Step-by-Step Architecture

1. Global State Management & Data

Structuresg_ResultAddresses:
Stores all matched target memory pointers as 64-bit integers (uintptr_t / __int64).

g_OriginalBytesMemory:
Automatically backs up original target bytes prior to patching, giving you an instant, native "Disable Cheat / Restore Original Bytes" functionality for your trainers.

CheckRule Structure:
Performs dynamic filtering beyond standard pattern matching by validating specific 2-byte short values at fixed offsets before accepting a match.

2. The 4 Core Execution Phases

Phase A:
Memory Mapping (VirtualQueryEx & ReadProcessMemory)
Scans valid process memory pages (MEM_COMMIT), skipping protected system guards (PAGE_GUARD) to pull safe, readable/writable memory blocks into high-speed buffers.

Phase B:
Pattern Matching with Wildcard SupportParsePattern handles ? and ?? wildcards by masking them with 0x00.

For example, scanning "02 ?? 00 00" safely ignores wildcard bytes while maintaining maximum search speeds.

Phase C:
Rule Validation & Byte BackupsWhen a pattern matches, optional CheckRule offsets are verified.
Upon passing, the original target bytes are backed up directly into g_OriginalBytesMemory.

Phase D:
Smart Patching (VirtualProtectEx & WriteProcessMemory)
When replacePattern is provided, page protections temporarily elevate to PAGE_EXECUTE_READWRITE.

Wildcards (??) in the replacement string are preserved, meaning only target bytes change while wildcard positions retain their original values.

🛠️ Exported DLL API Reference for Cheat Engine LuaAll functions are invoked seamlessly via executeCodeLocalEx:

1. ExecuteMemoryOperationThe primary engine method.
Performs memory sweeps, rule checks, original byte backups, and optional byte patching.

local success = executeCodeLocalEx(addr_Execute, pid, searchPattern, offsetToTarget, rulesPtr, ruleCount, replacePattern)
--Returns: 1 (true) if matches are found, 0 otherwise.

2. GetResultCountRetrieves the total number of valid matched addresses stored in the result vector from the last scan.
Lua Passed dummy argument '0' for x64 register alignment

local count = executeCodeLocalEx(addr_GetCount, 0)
--Returns: Total match count as a native integer.

3. GetResultAddressAtIndexRetrieves a specific 64-bit target address pointer by zero-based index.

local addr = executeCodeLocalEx(addr_GetAddr, index)
--Returns: 64-bit memory address ($0 \dots \text{count} - 1$), or 0 if index is out of bounds.

4. RestoreOriginalBytesReverts modified target memory back to its exact pre-patched state using native in-memory byte backups.

local restored = executeCodeLocalEx(addr_Restore, pid)
--Returns: 1 on successful restoration.
--Perfect for instant "Disable Cheat" toggles.

5. GetLastOperationResultChecks the success flag of the most recent memory operation.

local isOk = executeCodeLocalEx(addr_GetLastResult, 0)
--Returns: Boolean operation state (1 / 0).

6. SimpleAobScanA streamlined bridge designed for quick AOB scanning and patching without rule structures or offsets.

local success = executeCodeLocalEx(addr_SimpleScan, pid, searchPattern, replacePattern)
--Returns: Direct patch success state.🎯

SummaryThis project is a complete, high-performance Trainer Backend Engine.

Rather than just scanning memory, it provides:
Offset-Filtered Sweeps via CheckRule structures.
Wildcard-Aware Replacement Patching preserving unmodified byte positions.

Native Byte Backups stored directly in C++ memory.
One-Click Memory Restoration via RestoreOriginalBytes.
With this setup, you aren't just reading target addresses into Cheat Engine—you have full control to patch memory safely and restore target processes back to their original state in milliseconds!


Key Improvements Included:

Automatic 12-Byte Binary Packing:
The ruleOption parsing packages rules directly via string.pack("i4i4i4", off, val, eq) to match C++ alignment without exposing raw pointer allocations to script writers.

Safe Memory Release:
Allocated rule memory buffers are immediately deallocated via deAlloc(rulesPtr) right after executeCodeLocalEx returns.

Flexible ruleOption Structure:
Accepts both direct rule arrays
{ { offset = 0x01, value = 2, isEqual = true } }
and extended configurations

ruleOption = { { offset = 0x01, value = 2, isEqual = false },
{ offset = 0x04, value = 0, isEqual = true },
{ offset = 0x0A, value = 255, isEqual = true } }

Probability rules:
Logically, the following three rules are sent to the C++ side at once (multi-rule):

Rule 1: The value at the offset of the address +0x01 MUST NOT be 2 (isEqual = false).

Rule 2: The value at the offset of the address +0x04 MUST be 0 (isEqual = true).

Rule 3: The value at the offset of the address +0x0A MUST be 255 (isEqual = true).



The AOB Engine supports compressed pattern tokens, allowing you to express repeated bytes in a compact form.

For example, the pattern:
28 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF FF FF FF FF FF FF

You can shorten this code as follows:
28 11x?? 4xFF FF FF FF FF

is automatically expanded by the engine into:

28

?? repeated 11 times

FF repeated 4 times

followed by the remaining FF bytes

This makes complex signatures easier to write and reduces visual clutter in large AOB patterns.
The engine parses each token, detects the NxYY format, and generates the correct number of masked pattern entries internally before scanning memory.

This feature works seamlessly with rule-based filtering and replacement patterns, allowing highly precise, multi‑stage AOB operations.

USE MODULE: