Cheat Engine

ghmarko · Posted: Mon Mar 30, 2020 8:49 am Post subject: Memory Reading api's

can anyone here give me a list of api's used for memory reading ?

atom0s · Posted: Mon Mar 30, 2020 2:22 pm Post subject:

Finding the process:
- FindWindow (to find based on window name or window class.)
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

PSAPI has its own set of API that does the same stuff as well:
https://docs.microsoft.com/en-us/windows/win32/psapi/psapi-functions

Opening the process:
- OpenProcess

Memory related:
- ReadProcessMemory
- WriteProcessMemory
- VirtualAllocEx
- VirtualProtectEx
- VirtualQueryEx

And so on, these are the main ones that are the most commonly used from a trainer standpoint that is external and from usermode.

ghmarko · Posted: Mon Mar 30, 2020 2:30 pm Post subject:

DanyDollaro · Posted: Mon Mar 30, 2020 4:47 pm Post subject:

Check if there are codes that act on reading the section of code you are using to redirect the thread (the injection point).
Normally you can solve it with a "stealth edit" or bypassing the integrity check.

ghmarko · Posted: Tue Mar 31, 2020 5:48 am Post subject:

OldCheatEngineUser · Jul 26, 2020

https://forum.cheatengine.org/faq.php#1

note:
regardless of what API's you are using and whether they are usemode or kernelmode API's, if the game is shipped with a built-in integrity-check then none of the API's will help.

(if no integrity-check then yes some API's can help, but again CEF have some rules so check the FAQ)

atom0s · Posted: Tue Mar 31, 2020 11:37 pm Post subject: