Cheat Engine

[ulysse31]

So I did some research on how memory scanners do their work and I came across Crysearch which seems to be the most different than CE in terms of searching variables :
It uses multithreading and saves reslults in I/O files.

Using unknown initial value and fastscan disabled (4 bytes length variable) I decided to compare CE and Crysearch on a 700 Mo program : Skype.exe
While CE doesn't save results to disk, the CE.exe program size increased significantly as expected, no thread were created (monitoring from process explorer.exe) and seeminly the cpu wasn't used above 1%. Scans over in seconds.

Crysearch would last around 3 times longer, possibly go to 20% CPU, create 1/2 threads (i expected many more) and would not see its virtual space impected, as expected considering results are saved to disk.

After some documentation I'd like 2 asumptions to be confirmed :
1/ Considering there is no I/O (and no operations subject to waiting idle) inside the scan, on a CPU with X cores, making the scan use more than X threads will not increase performance, true ?

2/However if part of the scanned memory has been paged to disk by the OS, scanning threads could potentially wait for disk to provide data which would mean that the more threads, the better the performance ?

[atom0s]

There are configurations for Cheat Engine that you would need to look into if you are going to compare the two more effectively. Cheat Engine does store its search results to disk for faster response times. You can find that data, by default, inside of the %temp% folder on your system under 'Cheat Engine'.

You can also configure this output location in CE's settings:
Settings -> Scan Settings

You can also alter the scanner a bit inside of these settings to change what it will and won't include during scans.

Under the 'Extra' settings the kernel function options can also affect scan times.

[Dark Byte]

unless you compiled ce yourself with the 'nomt' define, the scans are multithreaded. (it spawns threads for each cpu)

1: right, if there is no blocking operation more than X won't give much improvement and may even decrease speed

2: kinda, but don't forget that it can cause other memory to get paged out.


(if you compile ce with the 'lowmemusage' define it will also write the results to disk)

[ulysse31]

Great, thank you both