Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Auto terminate memory scanning for certain conditions

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Xillica
Cheater
Reputation: 1

Joined: 28 Jun 2015
Posts: 45

PostPosted: Mon Aug 24, 2015 1:35 am    Post subject: Auto terminate memory scanning for certain conditions Reply with quote

I usually grouped search physical memory to edit the bluestacks value for some games and in my case the memory range for the value usually located from 70000000-BFFFFFFF (mostly ranging from 80000000-9FFFFFFF). But physical memory scanning is slow even with specific address range like that, but I noticed that if I terminate the scanning halfway it already found the value structure that I need.

So my question is, is it possible to make the cheatengine terminate the scan automatically after its found 1 result or so? Because my grouped scanning always return 1 result (unique value structure), and to speed up the search I always terminate the scan manually.

_________________
Toukiden Kiwami cheat table: forum.cheatengine.org/viewtopic.php?p=5600876#5600876
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 457

Joined: 09 May 2003
Posts: 25262
Location: The netherlands

PostPosted: Mon Aug 24, 2015 3:44 am    Post subject: This post has 1 review(s) Reply with quote

try this (untested)

execute this lua code
Code:

getCurrentMemscan().OnlyOneResult=true


after the scan the list will probably stay empty, just execute this to get the result
Code:

return string.format("%x", getCurrentMemscan().Result)


also, why not use andy? You don't need to scan physical memory there

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Xillica
Cheater
Reputation: 1

Joined: 28 Jun 2015
Posts: 45

PostPosted: Mon Aug 24, 2015 6:43 am    Post subject: Reply with quote

Hi Dark Byte, thanks for answering. I'm not knowledgeable yet with LUA, so is it possible to execute a LUA code that will do the grouped scanning and return the result to the table?

for example I search for this value structure:
f:1135 w:36 4:539 w:16 4:* w:32 4:* w:4 4:*
Then it will return
-float value (1135)
-36 bytes space
-4 bytes value (539)
-16 bytes space
-4 bytes value (unknown)
-32 bytes space
-4 bytes value (unknown)
-4 bytes space
-4 bytes value (unknown)

Maybe this code can add the result found to the table
Code:
ms=createMemScan()
ms.OnlyOneResult=true
ms.FirstScan(soExactValue, vtGrouped, rtRounded, "f:1135 w:36 4:533 w:16 4:* w:32 4:* w:4 4:*","", 0x80000000, 0x9fffffff,"", fsmNotAligned,"1", false, false, false, false)
ms.waitTillDone()

al=getAddressList()
a="0x"..ms.Result

mr=al.createMemoryRecord()
mr.Address=string.format("%x", a)
mr.Type=vtSingle
mr=al.createMemoryRecord()
mr.Address=string.format("%x", a+40)
mr=al.createMemoryRecord()
mr.Address=string.format("%x", a+60)
mr=al.createMemoryRecord()
mr.Address=string.format("%x", a+96)
mr=al.createMemoryRecord()
mr.Address=string.format("%x", a+104)

ms.destroy()

I can't get the code working properly, always BSOD (Physical memory scanning), or maybe there is more practical way to return the result without executing the LUA code? Just pressing the first scan button like usual.


Thanks for the help beforehand.

PS: I tried Andy before but the values found can't be edited for some reason, any clue why? It found the address but I can't edit it at all, like it was protected or so (I'm using the latest Andy emulator by the way)

_________________
Toukiden Kiwami cheat table: forum.cheatengine.org/viewtopic.php?p=5600876#5600876
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 457

Joined: 09 May 2003
Posts: 25262
Location: The netherlands

PostPosted: Mon Aug 24, 2015 11:32 am    Post subject: Reply with quote

That code should work, assuming the data you're looking for is in that specific region. (there's really no guarantee at all, that the memory you're looking for is there. It's mostly based on luck)

You do also use kernelmode query memory regions ?
Oh, and NEVER open the settings window after selecting [Physical memory]


As for Andy, try with kernelmode memory editing enabled (or if it's enabled, turn it off)

Alternatively, go to that address in memoryview, note down the physical address, open [physical memory], go to the specific physical address and edit it there

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Xillica
Cheater
Reputation: 1

Joined: 28 Jun 2015
Posts: 45

PostPosted: Mon Aug 24, 2015 12:19 pm    Post subject: Reply with quote

Dark Byte wrote:
That code should work, assuming the data you're looking for is in that specific region. (there's really no guarantee at all, that the memory you're looking for is there. It's mostly based on luck)



About the BSOD, I already found the cause. It is very fatal actually (my stupid mistake), and I just realized after I print the value of the address stored in the memscan Result property. Its stored as integer already, so I don't need the hassle to add "0x".. for the variable (I didn't now about this since I can't found the documentation about it in the wiki). And for the specific region, I don't know why but the range always around 70000000-BFFFFFFF (mostly around 80000000-9FFFFFFF) at least for me.

Dark Byte wrote:
You do also use kernelmode query memory regions ?
Oh, and NEVER open the settings window after selecting [Physical memory]


Kernelmode query memory regions always unchecked for me since I don't know what it's used for and I can found the value from physical memory scanning just fine. For the settings window after selecting [Physical Memory], I've never opened it ever again after I experienced multiple BSODs Laughing. (and found out about it after digging some info in the cheatengine forum)

Dark Byte wrote:
As for Andy, try with kernelmode memory editing enabled (or if it's enabled, turn it off)

Alternatively, go to that address in memoryview, note down the physical address, open [physical memory], go to the specific physical address and edit it there


For the Andy, what do you mean by kernelmode memory editing?

I can only found these settings:
-Kernelmode debugger (requires DBVM)
-CE kernel routines:
*Query memory region routines
*Read/Write Process Memory
*Open Process

Also thank you very much Dark Byte for helping me once again Very Happy

_________________
Toukiden Kiwami cheat table: forum.cheatengine.org/viewtopic.php?p=5600876#5600876
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites