Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Help on making a memory scanner in vb.net or c#

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
cskult
How do I cheat?
Reputation: 0

Joined: 05 Mar 2009
Posts: 9
PostPosted: Sat Apr 30, 2011 8:13 pm    Post subject: Help on making a memory scanner in vb.net or c# Reply with quote
Hi,
Im trying to make a memory scanner (CE) in vb.net I got the scanning but i cant figure how to scan it fast (it only does 1 every millisecond which would take like 23 days to go through the whole memory o.O) so i wonder if anyone knows how to make it read more at once with readprocessmemory a c# example (simple) would be better than nothing

Thx for all help and please ask if anything is unclear
Thx in advance

Cheers
_________________
Give a man a fish and you feed him for one day, teach the man to fish and you give him food for the rest of his life
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
PostPosted: Sat Apr 30, 2011 11:01 pm    Post subject: Reply with quote
Dump the memory in sections (once per part) and then scan/filter through it locally. Don't keep reading from memory constantly.
Use ReadProcessMemory efficiently.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
cskult
How do I cheat?
Reputation: 0

Joined: 05 Mar 2009
Posts: 9
PostPosted: Sun May 01, 2011 3:35 am    Post subject: Reply with quote
Yes that is my problem, how do i do this Razz
_________________
Give a man a fish and you feed him for one day, teach the man to fish and you give him food for the rest of his life
Back to top
View user's profile Send private message
ej52
Cheater
Reputation: 0

Joined: 29 Mar 2011
Posts: 39
Location: Mother City
PostPosted: Sun May 01, 2011 3:38 pm    Post subject: Reply with quote
It would help if u posted ur code so we could see what u are doing wrong Razz

As Wiccaan said "scan the memory in sections".

For example read 64kb at a time ...

Code:

for (int i = 0x10000000; i < 0x20000000; i += 65536)
{
     // Code to read memory
}

_________________
Hitler dNt HiDe WaT mOtHa NaTurE pRoViDe ... Razz
Back to top
View user's profile Send private message
cskult
How do I cheat?
Reputation: 0

Joined: 05 Mar 2009
Posts: 9
PostPosted: Sun May 01, 2011 5:15 pm    Post subject: Reply with quote
Will do:

Code:

    Private Sub cmdFirstScan_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdFirstScan.Click
        On Error GoTo ErrScan
        Dim intStart, intStop, intValueSearch, intValueFound As Integer
        Dim whatToAdd(1) As String
        Dim itm As ListViewItem
        pbScan.Value = 0

        For clearList = 0 To lstResults.Items.Count - 1
            lstResults.Items.RemoveAt(clearList)
        Next clearList

        intStart = CInt("&H" + txtStart.Text)
        intStop = CInt("&H" + txtStop.Text)
        intValueSearch = CInt(txtScan.Text)


        For i = intStart To intStop
            Application.DoEvents()
            intValueFound = ReadMemory(SelectedProcess, i)
            If intValueFound = intValueSearch Then
                whatToAdd(0) = Hex(i)
                whatToAdd(1) = intValueFound
                itm = New ListViewItem(whatToAdd)
                lstResults.Items.Add(itm)
            End If
            lblCurrentAd.Text = Hex(i)
            pbScan.Value = (i / intStop) * 100

            If bolAbortScan = True Then
                pbScan.Value = 100
                MsgBox("Scan aborted", vbInformation, "Abort:")
                bolAbortScan = False
                Exit Sub
            End If
        Next i

        Exit Sub
ErrScan:
        MsgBox("Error: " & Err.Description, vbCritical, "Error:")
    End Sub


Thats the code i got by now, or at least all i think you need
and

Code:

Public Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer


Well, the problem is it reads 1 and 1, and not in chunks... idk how to do that,

Thx for all the help, hope you can help me out, im very greatful for the replies

Cheers
_________________
Give a man a fish and you feed him for one day, teach the man to fish and you give him food for the rest of his life
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
PostPosted: Sun May 01, 2011 5:33 pm    Post subject: Reply with quote
Use VirtualQueryEx to obtain the page information for the process.
You can then read by page and adjust your scanning based on the page access.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
cskult
How do I cheat?
Reputation: 0

Joined: 05 Mar 2009
Posts: 9
PostPosted: Sun May 01, 2011 7:06 pm    Post subject: Reply with quote
mind to show an example?
_________________
Give a man a fish and you feed him for one day, teach the man to fish and you give him food for the rest of his life
Back to top
View user's profile Send private message
cskult
How do I cheat?
Reputation: 0

Joined: 05 Mar 2009
Posts: 9
PostPosted: Sun May 08, 2011 4:52 am    Post subject: Reply with quote
i guess not Sad after what i found out that function is not available in vb.net, so i could really use an example

EDIT:

This is what i have so far and, from all i know, need but im still lost on this:

Code:

    Declare Auto Sub GetSystemInfo Lib "kernel32.dll" (ByRef Info As SYSTEM_INFO)
    Public Declare Function VirtualQueryEx Lib "kernel32" Alias "VirtualQueryEx" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, <Out()> ByVal lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long

    <StructLayout(LayoutKind.Sequential)> _
    Structure SYSTEM_INFO
        Dim ProcessorArchitecture As Int16
        Dim Reserved As Int16
        Dim PageSize As Int32
        Dim MinAppAddress As Int32
        Dim MaxAppAddress As Int32
        Dim ActiveProcMask As Int32
        Dim NumberOfProcessors As Int32
        Dim ProcessorType As Int32
        Dim AllocGranularity As Int32
        Dim ProcessorLevel As Int32
        Dim ProcessorRevision As Int32
    End Structure
    <StructLayout(LayoutKind.Sequential)> _
    Public Structure MEMORY_BASIC_INFORMATION
        Dim BaseAddress As IntPtr
        Dim AllocationBase As IntPtr
        Dim AllocationProtect As UInt32
        Dim RegionSize As IntPtr
        Dim State As UInt32
        Dim Protect As UInt32
        Dim lType As UInt32
    End Structure


EDIT 2:

I also found some useful code, but i need some help on finishing it it was in vb6 xD

Code:

 Const PROCESS_VM_READ = (&H10)
    Const PROCESS_VM_WRITE = (&H20)
    Const PROCESS_VM_OPERATION = (&H8)
    Const PROCESS_QUERY_INFORMATION = (&H400)
    Const PROCESS_READ_WRITE_QUERY = PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_VM_OPERATION + PROCESS_QUERY_INFORMATION
    Const MEM_PRIVATE& = &H20000
    Const MEM_COMMIT& = &H1000

    Public Sub ScanMemoryFast(ByVal proces As String, ByVal SearchFor As String, ByVal fromAddress As Integer, ByVal toAddress As Integer)
        Dim pid As Long, hProcess As Long, hWin As Long
        Dim lpMem As Long, ret As Long, lLenMBI As Long
        Dim lWritten As Long, CalcAddress As Long, lPos As Long
        Dim sBuffer As String
        Dim sSearchString As String, sReplaceString As String
        Dim si As SYSTEM_INFO
        Dim mbi As MEMORY_BASIC_INFORMATION
        sSearchString = SearchFor

        Dim myProcesses() As Process = Process.GetProcessesByName(proces)
        If myProcesses.Length = 0 Then
            Exit Sub
        End If

        pid = myProcesses(0).Id

        'Open process with required access
        hProcess = OpenProcess(PROCESS_READ_WRITE_QUERY, False, pid)
        lLenMBI = Len(mbi)
        'Determine applications memory addresses range
        Call GetSystemInfo(si)
        lpMem = fromAddress
        'Scan memory
        Do While lpMem < toAddress
            mbi.RegionSize = 0
            ret = VirtualQueryEx(hProcess, lpMem, mbi, lLenMBI)
            If ret = lLenMBI Then
                If ((mbi.lType = MEM_PRIVATE) And (mbi.State = MEM_COMMIT)) Then ' this block is In use by this process
                    If Not mbi.RegionSize = 0 Then
                        sBuffer = String(mbi.RegionSize, 0) ' HERE I NEED HELP: I dont know what string(whatever, whatever) would be equal to in vb.net i tried strdup but it gave me an error
                        'Read region into string
                        ReadProcessMemory(hProcess, mbi.BaseAddress, sBuffer, mbi.RegionSize, lWritten)
                        'Check if region contain search string
                        lPos = InStr(1, sBuffer, sSearchString, vbTextCompare)

                        ''Remove AFTER
                        If lPos = True Then
                            MsgBox("Found Value @ ") 'HERE I NEED HELP: I dont know where you find what value it finds the value i search for in
                            Exit Sub
                        End If
                        'REMOVE
                    End If
                End If
            End If

        loop
    End Sub


2 places i need help (i think) u can find them in the code THX A LOT
_________________
Give a man a fish and you feed him for one day, teach the man to fish and you give him food for the rest of his life
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
PostPosted: Sun May 08, 2011 11:34 am    Post subject: Reply with quote
All API can be invoked in VB.NET you just need to create the proper DllImport definition. You can use PInvoke for all of the ones you don't know:

http://pinvoke.net/
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites