Cheat Engine

[Tris]

I recently started coding a memory scanner. I itterate through all of the memory regions using VirtualQueryEx and store each memory region along with all of its data into a dictionary of <int, byte[]>. Everything in that part seems fine and is relitively fast.

When it comes to processing the data to find values it can take anywhere between 6 - 12 seconds to find a full list of values in a process that takes roughly 300mb memory usage. This isn't really ideal, especially for pointer scanning.

Essentially what I'm doing is:

[Dark Byte]

it helps if you use defines instead of 0x1000, 0x04, 0x08, etc...
anyhow, The regions to scan for seem to be alright

One tip: After creating the region map split it up into smaller chunks and pass that to worker threads that do the reading (if you have a multicore system that can speed it up a bit)

if you want to make a pointerscan you will have to come up with a better algorithm.

Cheat Engine's pointerscanner for example doesn't really store the memory, but only the pointer values it encounters.
Each pointer value gets stored in a map, and for each pointer value I store which addresses contain that pointervalue (hence the occasional 4GB+ map database in memory...)

After building that list (that is the progresbar at the beginning) it checks which pointers have a value that point between the given address and the given address-structsize

Then for each address with that value it does the same until the maximum level is found and then continues with the next result

And to increase the speed the workload is split up between several threads that make use of the same pointermap map (it's read only anyhow so no slowdown by locks)