Cheat Engine

Symbol · Posted: Fri Jan 11, 2008 10:47 pm Post subject: [Question]Memory Scanning.

Hi, I can scan really really really slow. (00010000 addresses is slower than CE's scan of 00400000 to 80000000)
I tried empty loops, such as
for (int i = 0; i < 10000; i++)
{

}

while (i < 10000)
{
i++;
}

Also slow... untill it reachs 10000 without reading memory at all, cheat engine can scan all the memory... is it because its .NET? (Its in C#)

I just tested:

HolyBlah · Posted: Sat Jan 12, 2008 7:10 am Post subject:

I quite sure that CE show doesn't load FFFFFFFF addresses in the same time.
It only shows the adresses that you look in the Memory browser (about 16 adresses).

Symbol · Posted: Sat Jan 12, 2008 8:28 am Post subject:

I didn't mean the memory view, I also thought thats what it does in the memory view, but I decided to make a scanner first.
My question is how does CE scan so fast?

Dark Byte · Posted: Sat Jan 12, 2008 9:18 am Post subject:

1:
Ce first gets the available memory regions that there are. so doesn't even bother reading memory that doesn't exist)

2:
make sure you don't call windows API's in your scanning loops

if you need to read 2 addresses that are within a 4096 byte range, do a readprocessmemory call on the whole block of 4096 bytes and then just check those 2 addresses in there. (it's a lot faster than calling readprocessmemory twice)

And in your example of "List.Add(i.ToString()); ":
for one, that's going to eat up a lot of ram, and will have a lot of memory relocations happening. (sure it has a small buffer to handle it, but I don't think it's big enough for 0x40000 items, so has to reallocate a new buffer each time. More api calls)

also:

Symbol · Posted: Sat Jan 12, 2008 11:47 am Post subject:

Thanks, it scans much faster, only one problem is adding the items to the list... CE adds like 100,000 items in a second and mine adds 10,000 slower... Rolling Eyes

Anyway, how can I check if the memory exists? because ce shows ?? for empty memory but when I use readprocessmemory it shows 0... or maybe its null converted to 0?

Dark Byte · Posted: Sat Jan 12, 2008 12:23 pm Post subject:

ce doesn't really add them to the list. It only adds them to a file.

The listbox gets filled with information regarding the records visible. (thats why you may see the harddisk led turn on when dragging the results of the foundlist around, since each time the scroller moves the addresses are read from disk and values updated)

Virtualqueryex can be used to do that.
Also, in the memory browser ce doesn't read the memory for each single byte, it read it in blocks of 4096 bytes, and if a block isn't readable (e.g rpm returns false or bytesread=0) it puts a ?? instead of a value