Cheat Engine

Adversities · Newbie cheater Reputation: 0 Joined: 19 Aug 2016 Posts: 10

I'm stuck... Why? well because Cheat Engine ignores memory regions, yes, sounds weird, but it's true and i dont know why it does that.
Let me give you an example, we want to find the addresses with the following value: 00 A0 BA 85 (Cheat Engine founds: 2k Results) (My program founds: 35k Results [Them're ok, i've checked it with Memory Browser from CE, and them has the correct value]) then what that means? it means that Cheat Engine ignores memory regions to make scans faster, but i dont know in what it's based to ignore regions, so i dont want my scan to get 33k Results more than Cheat Engine, it's not all, i'm just curious, why the fuck Cheat Engine ignores regions? if someone can help me understanding in deep i'd be really grateful.

hhhuut · Posted: Thu Aug 25, 2016 5:21 am Post subject:

Below the "Value Type" Dropdown, you have a small box titled with "Memory Scan Options".
With these you can determine/tell CE what kind of memory to scan.
I guess you got so many results more becuase you don't care what memory the value is in.

If you want CE to scan everything it has access to, right-click on the "Writable" checkbox and select "Preset: Scan all memory", uncheck the "FastScan" option, goto Edit -> Settings -> Scan Settings and tell CE to also check the "MEM_MAPPED" memory.
Then search for your value again.

Dark Byte · Posted: Thu Aug 25, 2016 6:08 am Post subject:

By default CE skips MEM_MAPPED regions and readonly memory as well.

Also, is your scanner injected? If it is and you store the found value, your scanner could have found that storage. And each addrrss in there gets added again...

Adversities · Newbie cheater Reputation: 0 Joined: 19 Aug 2016 Posts: 10

hhhuut · Posted: Fri Aug 26, 2016 3:01 am Post subject:

Cool you figured it out, for everyone else asking the same question.

If you call VirtualQuery(Ex) on an address, you get a pointer to a [url=https://msdn.microsoft.com/de-de/library/windows/desktop/aa366775(v=vs.85).aspx]MEMORY_BASIC_INFORMATION[/url] structure. This structure contains the members "Protect" and "AllocationProtect", which refer to the [url=https://msdn.microsoft.com/de-de/library/windows/desktop/aa366786(v=vs.85).aspx]Memory Protection Constants[/url] with which you can easily determine the access state of a specific region.

As to the Fast Scan option, with this enabled, CE will skip all addresses which are not divisible without remainder by the value specified.
So i.e. with the default Fast Scan value for an Integer (which is 4), there will only be address in the address list, which end on 0, 4, 8 and C.

Adversities · Newbie cheater Reputation: 0 Joined: 19 Aug 2016 Posts: 10

Oh yeah i figure it out but i forgot the fast scan thingy can you please explain it completely? sorry i didn't get what it exactly does (maybe later i understand this without an answer but maybe not, and your help is so great)