Cheat Engine

Chaosis13 · Posted: Tue Feb 17, 2009 8:36 pm Post subject: How does cheat engine search?

How does cheat engine search addresses?

I am wanting a technical explanation... Like the method it uses to not lag and to do it quickly...

Does it copy the addresses to its memory, then search? Or does it search directly through the processes memory?

I making my own hacking tools, and want to know...

Snow1337 · Posted: Wed Feb 18, 2009 9:46 am Post subject:

Well im not going to get all technical with it because theres no sense in me wasting time when it can be answered simply.

It searches through the process (game/program) for certain values that correspond to addresses (4 byte hex)

LOL SIMPLE, RIGHT?

lnquisitor · Posted: Wed Feb 18, 2009 1:03 pm Post subject:

As far as I understand, cheat engine analizes the values of each memory "Box" (Address) and searches those which match your value. Modern PC's can handle many operations at a time, so its not a problem.

Chaosis13 · Posted: Wed Feb 18, 2009 5:31 pm Post subject:

YES IT IS SIMPLE, I already knew that.

I mean what METHOD does it use?

When I use a DLL file using pointers and checking each one individually it works fine for small regions. BUT, when I search through areas bigger than.... lets say 400000 bytes it crashes. So does cheat engine do something special so it doesn't crash?[/b]

Dark Byte · Posted: Wed Feb 18, 2009 5:47 pm Post subject:

http://ce.colddot.nl/wiki/memscan describes some of it

Anyhow, in short: It uses VirtualQuery to find out which memory regions are readable and then reads those regions

Also, you still have to use a try/except or suspend all threads except the scanner thread, else it may happen a block of memory gets freed by the other threads while your thread is scanning.

Chaosis13 · Posted: Wed Feb 18, 2009 9:34 pm Post subject:

oh... ty!

I was searching through everything, this will help alot!

lylcheat · Posted: Sun Mar 01, 2009 4:45 am Post subject:

I also wonder how it locate byte boundary of multi-byte values (like float/double). Any 1 knows?
For example, for a single 4 byte value, it could mean these 4 addresses:
(0x200000, 0x200001,0x200002,0x200003) or these 4
(0x200001, 0x200002,0x200003,0x200004) or these 4
(0x200002,0x200003,0x200004, 0x200005) ,etc
Does it simply search for all possible combinations?