Cheat Engine

samuri25404 · Posted: Mon Jul 30, 2007 5:18 pm Post subject: [CE]Memory Regions

I'm writing a memory scanner with my dad in C#, and because there are so many addresses in a Win32 program (400000 - 7FFFFFFF), it takes forever to scan. However, using Memory Regions (as I believe CE does), one could eliminate all of the unused memory, and just scan the needed memory.

At ~300k Addresses a second (my dad tested), one could easily get through the used memory.

Now, I know that CE takes only a few seconds to scan the program for a value, so I'm guessing that it doesn't scan the unused memory.

How does it do this?

I have checked the Delphi source code with my dad, but the stuff just baffles us both (we used Ultra Edit's find in file function, for one of the functions that the New Scan thing that the main window).

Dark Byte · Posted: Mon Jul 30, 2007 7:38 pm Post subject:

virtualqueryex
and if kernelmode virtualqueryex is chosen it looks at the pagetable

samuri25404 · Posted: Mon Jul 30, 2007 8:11 pm Post subject:

Thank you very much.

I think my dad and I actually found something with VirtualQueryEx, and we added it to a class with some other stuff like ProcessMemoryReading and writing.

When you say "KernelMode", are you referring to the option in the Settings under the Extra Tab? And the page table is that little box that it has?