Cheat Engine

[Ballesaft]

So i am trying to create a memory scanner like for example TSearch or Artmonkey for educational purposes and i find it a good task to improve my knowledge about memory, anyways i have written the code below and it succesfully retrieves the chunks from memory and it is able to find some of the values i am scanning for, say i tell it to look for an int with a value of 34, well it finds 3 results, i mean thats all good but the problem is that TSearch, Artmonkey and cheat engine are all able to find so much more, i only get about 20-30% of the results that other memory scanners find, why is this ? i was hoping someone could help me with this i have tried different solutions like changing the region protection filters, only looking at memory with MEM_COMMIT etc.. but i always get the same amount of data and variables :/

i also run it all in an elevated process with debug privileges aswell :S so i really don't know and any help would be appreciated.

Code:

[DTeCH]

This may sound cheesy but, step through slowly near the end, & see where it stops looping through the process's "pages", & make sure you're going through all detected memory total to be scanned. Avoid all that will not be scanned/filtered out.

In my scanners (The fastest I've ever seen lol... honest!) , just before the loop to do the filtering + scanning (Assuming your coding is similar to mine), do a quick duplicate loop that just adds all the wanted memory page's sizes you want together, & skip over the ones you don't... no other code, just set a TotalKnownBytesToScan variable to use in the next main loop. When you get your total, make sure you add each byte scanned in the next main filtering + scanning loop in every cycle... including all error traps, skips, jumps + whatever. Make sure ALL routes to the loop next adds to this variable before continuing next loop cycle. Continue until your added total >= TotalKnownBytesToScan variable from the first short loop.

You might want to put a breakpoint on a temp line that checks to see if "CurrentBytesScanned >= TotalKnownBytesToScan" just to see if it ever gets hit. If not, then your code is falling short somewhere, & if that's the case, check to see if any variable has a minus "-" sign at the left of it. that minus sign means different things in the eyes of different calculation functions under the hood. In one case it's an overflow, in another case it's a signed int. IntPtr likes to assume different variable types based on whether it's running in 32, or 64 bit mode, & this alone can cause the infamous "-" to appear in the variables. Just to be safe, place a breakpoint on a temp line that will break somewhere inside your detected "possible matching address" checking function call (or loop), & visualize what's being checked, & compared... just to make sure the code is doing exactly what you expect. Sleep is killing me right now, so I'll return later if God's willing, & tidy this post up a bit.

ps: Pretend my spelling is awesome! lol

[Ballesaft]

Thank you for your reply, i did as u said and created a variable with the total size of all the pages in memory when added together, i found something weird tho the total bytes of all pages all together is only 250kb of a process that task manager says is using 6080kb, so im clearly not fetching all pages or memory that i am supposed to my loops are working fine and scans all the fetched memory, im just having a problem with fetching it all, maybe there is something wrong with my filtering ? ima look into the filters a litlle, feel free to reply if u have any ideas, even the slightest detail or idea u guys have is worth sharing.

best regards.