Cheat Engine :: View topic - Faster Memory Scanner than what I already have [VB.net 2008]

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Faster Memory Scanner than what I already have [VB.net 2008]

Cheat Engine Forum Index -> General programming

View previous topic :: View next topic

Author

Message

ragespark
How do I cheat?

Reputation: 0

Joined: 18 Jan 2013
Posts: 1

Posted: Fri Jan 18, 2013 3:41 pm Post subject: Faster Memory Scanner than what I already have [VB.net 2008]

I'm in the process of creating a trainer and the issue that comes to me is that everytime I load the same game in flash the memory address for the byte array "2c dd 1e" changes, I finally figured out the problem but now I've came across the issue of the memory scanning to be extremely slow.
here is my source code

Code:

Imports System.Runtime.InteropServices
Imports System.Diagnostics
Public Class Form1
#Region "Import Functions From kernel32.dll"
<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function VirtualAllocEx(ByVal hProcess As IntPtr, _
ByVal lpAddress As IntPtr, _
ByVal dwSize As Integer, _
ByVal flAllocationType As Integer, _
ByVal flProtect As Integer) As IntPtr
End Function

<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function VirtualFreeEx(ByVal hProcess As IntPtr, _
ByVal lpAddress As IntPtr, _
ByVal dwSize As Integer, _
ByVal dwFreeType As IntPtr) As Boolean
End Function

<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function WriteProcessMemory(ByVal hProcess As IntPtr, _
ByVal lpBaseAddress As IntPtr, _
ByVal lpBuffer As Byte(), _
ByVal nSize As IntPtr, _
ByRef lpNumberOfBytesWritten As IntPtr) As Integer
End Function
#End Region

#Region "Declare Constant"
Const MEM_COMMIT = &H1000
Const MEM_DECOMMIT = &H4000
Const PAGE_EXECUTE_READWRITE = &H40
#End Region

#Region "Function Declaration"
Private Function JmpCall(ByVal Cave As IntPtr, ByVal JumpFrom As Integer, ByVal iLen As Integer, ByVal _Jump As Boolean) As String
Dim Ins As String = GetIns(BitConverter.GetBytes(Cave.ToInt32 - JumpFrom - 5))
For i As Integer = 5 To iLen - 1
Ins += "90"
Next i
Return (IIf(_Jump, "E9", "E8") & Ins)
End Function
Private Function GetIns(ByVal BTS As Byte()) As String
Dim Ins As String = String.Empty
For i As Integer = 0 To BTS.Length - 1
Ins += String.Format("{0:x2}", Convert.ToUInt32(BTS(i)))
Next i
Return Ins
End Function
Private Shared Function HX2Bts(ByVal HXS As String) As Byte()
HXS = System.Text.RegularExpressions.Regex.Replace(HXS, "[^a-fA-F0-9]", "")
Dim buf As Byte() = New Byte(HXS.Length / 2 - 1) {}
For i As Integer = 0 To buf.Length - 1
buf(i) = Byte.Parse(HXS.Substring(i * 2, 2), System.Globalization.NumberStyles.HexNumber)
Next i
Return buf
End Function
#End Region
Dim hAddres As IntPtr = IntPtr.Zero
Private Shared Function SpecialByteCompare(ByVal b1 As Byte(), ByVal b2 As Byte(), ByVal b3 As Byte(), ByVal k As Integer) As Boolean
'readed memory, first byte array, second byte array, number of missing byte's
If b1.Length <> (b2.Length + k + b3.Length) Then
Return False
End If
For i As Integer = 0 To b2.Length - 1
If b1(i) <> b2(i) Then
Return False
End If
Next

'For i As Integer = 0 To b3.Length - 1
' If b1(b2.Length + k + i) <> b3(i) Then
' Return False
' End If
'Next
Return True
End Function
Private Shared Function GetMemoryAddressOfString(ByVal searchedBytes As Byte(), ByVal p As Process) As Integer
'List<int> addrList = new List<int>();
Dim addr As Integer = 0
Dim speed As Integer = 1024 * 64
Dim j As Integer = &H400000
While j < &H7FFFFFFF
Dim mem As ManagedWinapi.ProcessMemoryChunk = New ManagedWinapi.ProcessMemoryChunk(p, CType(j, IntPtr), speed + searchedBytes.Length)

Dim bigMem As Byte() = mem.Read()

For k As Integer = 0 To bigMem.Length - searchedBytes.Length - 1
Dim found As Boolean = True
For l As Integer = 0 To searchedBytes.Length - 1
If bigMem(k + l) <> searchedBytes(l) Then
found = False
Exit For
End If
Next
If found Then
addr = k + j
Exit For
End If
Next
If addr <> 0 Then
'addrList.Add(addr);
'addr = 0;
Exit While
End If
j += speed
End While
'return addrList;
Return addr
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Private Shared Function ReadProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, <Out()> ByVal lpBuffer As Byte(), ByVal dwSize As Integer, ByRef lpNumberOfBytesRead As Integer) As Boolean
End Function
Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
Dim MyProcess As Process() = Process.GetProcessesByName("Game")
Dim searchbyte() As Byte = New Byte() {&H2C, &HDD, &H1E}
Dim hAddress As Integer = VirtualAllocEx(MyProcess(0).Handle, IntPtr.Zero, 3, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
Dim searchstring As String = ""
Dim truememory As Integer = &H9C1284F
Dim stringz As Byte() = System.Text.Encoding.UTF8.GetBytes("quit_race")
Dim mem1 As Integer = GetMemoryAddressOfString(searchbyte, MyProcess(0))

Dim add As Integer = GetMemoryAddress(searchbyte)
Dim JumpCall As String = JmpCall(hAddress, add, 3, False)
Dim JumpBytes As Byte() = HX2Bts(JumpCall)
WriteProcessMemory(MyProcess(0).Handle, add, searchbyte, 3, IntPtr.Zero)

End Sub
Public Function GetMemoryAddress(ByVal searchbyte() As Byte) As Integer
Dim procs As Process = Process.GetProcessesByName("Game")(0)
'can replace with exit nag(message)+exit;
Dim p As IntPtr = OpenProcess(&H10 Or &H20, True, procs.Id)
'0x10-read 0x20-write
Dim PTR As UInteger = &H0
'begin of memory
Dim bit2search1 As Byte() = searchbyte
'your bit array until ??
Dim k As Integer = 0
'numer of missing array (??)
Dim bit2search2 As Byte() = {&H4F, &HBA}
'your bit array after ??
Dim buff As Byte() = New Byte(bit2search1.Length + (bit2search2.Length - 1)) {}
'your array lenght;
Dim bytesReaded As Integer
Dim finded As Boolean = False
Dim truememory As String = "F40E"
Dim scan As Integer = 0
Dim builthex As String = "lol"
'0841f40e
'0372f40e
'all of them contain f40e :D
PTR = 100000000
While PTR <> &HFFFFFFFF
'end of memory // u can specify to read less if u know he does not fill it all
ReadProcessMemory(p, CType(PTR, IntPtr), buff, buff.Length, bytesReaded)

If buff(0) = &H2C Then
If buff(1) = &HDD Then
If buff(2) = &H1E Then
Return PTR
finded = True
Exit While
End If
End If
End If
'If SpecialByteCompare(buff, bit2search1, bit2search2, k) Then
' 'do your stuff
' ' MessageBox.Show("Found! -" & PTR)
' Return PTR
' finded = True
' Exit While
'End If
PTR += &H1
End While
If Not finded Then
Return False
End If
End Function

End Class

any suggestions to speed this thing up?

Pingo
Grandmaster Cheater

Reputation: 8

Joined: 12 Jul 2007
Posts: 571

Posted: Sat Jan 19, 2013 5:32 am Post subject:

Probably cause its searching byte by byte.
Your entire class looks pieced together from other sources.
I recognize some of the smaller functions.

JmpCall
GetIns
HX2Bts
Are from my old mem class.

Anyway try this....

Code:

Public Function FindPattern(ByVal ProcessName As String, ByVal Pattern As Byte(), ByVal SearchRange As Integer) As Integer

Dim P As Process() = Process.GetProcessesByName(ProcessName)
If P.Length = 0 Then
Return -1
End If

Dim _Buffer As Byte() = New Byte(SearchRange) {}
ReadProcessMemory(P(0).Handle, P(0).MainModule.BaseAddress, _Buffer, _Buffer.Length, 0)

Dim sBytes As Integer() = New Integer(255) {}
Dim Len As Integer = Pattern.Length - 1, Dex = 0

For i As Integer = 255 To 0 Step -1
sBytes(i) = Pattern.Length
Next

For i As Integer = Len To 0 Step -1
sBytes(Pattern(i)) = Len
Next

While Dex <= _Buffer.Length - Pattern.Length
Dim i As Integer = Len
While _Buffer(Dex + i) = Pattern(i)
If i = 0 Then
Return P(0).MainModule.BaseAddress.ToInt32 + Dex
End If
i -= 1
End While
Dex += sBytes(_Buffer(Dex + Len))
End While

Return -1
End Function

Process Name without the .exe, example solitaire
Pattern, in your case 2c dd 1e
Search Range
Starts at the main module base and searches the range you specify.

Heres an example i searched in solitaire 8B D7 8B 7D 10 8D

Code:

FindPattern("solitaire", New Byte() {&H8B, &HD7, &H8B, &H7D, &H10, &H8D}, &HF0000)

If the function fails, it'l return -1.
If it succeeds, it'l return the first instance in that memory range.
_________________

Display posts from previous:

	Cheat Engine Forum Index -> General programming	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum