Thread: Memory Search Function

Ok. You can examine CheatEngine source, you will find a lot of interesting things.

In Olly, set debug options to break on new module (dll). Another quick method to stop debugger: make a call of MessageBox just before calling search function in your code, like
[code[call MessageBoxA
call <find value>[/code]
then BP on MessageBoxA in user32. After that, you can step by step trace your <find value> func

Shit completely missed the first topic.. yeah this delphi is really alien to me.. You don't know me on subspace.. I used to play with Qualified as Pokemon 2001 other then that I didn't really know anyone else other then that asian girl Jaclyan.

I recently was trying to make a automatic continuum bot that flys around TW/EG (big zones) and kills like normal player from boredom.. I got very far.. managed to port the whole encryption from Continuum v0.40.. but these packets follow so much formats.. I did research some called Clusters some called Big Chunks/Small Chunks/Reliable Packets.. really pissed me off and I gave up on the project :p. I attempted to ignore these stupid packets.. only the ones i need.. like player positions and death packets etc.. but then I tried send packets back to server.. nothing happened.. Very strange never had this type of problem with any game.. But then again Continuum uses UDP protocol for all packet stuff.. maybe I did something wrong ehh.. I quit like you well..

But Continuum does give you this good feeling.. people shit talk and shit on you all day.. then you win.. and just leave to piss people off good feeling..

Also the feeling you can only get from subspace you get team killed.. then you play it cool.. and when the guy who team killed you least expects it.. kill him , he rages in private chat.. noob learn to play reported.. LOL. Then those people who really take the game seriously as ****, training everyday to hit invisible ships lol to learn shots and shit damn those people are committed.

Well I know no delphi sorry cannot help there.. but I tried to peice some code together might not even compile.

Delphi
Inc(p, skipLength[Pointer(Cardinal(p) + lastByte)^]);
As for this code
p += skipLength[p[lastByte]];

Artist no, i am more coder than designer...
One benefit of being Trenchwars's head web developer for a time while i was staff i suppose.


Update:

So after a bit of a coding session and bouncing ideas off people, i might have got the original function i posted working.
Still need to debug some more and do some sanity checks on the pointer and bytes found at that address for patching, but hey it doesn't crash now and looks like it's getting the correct pointer address!

Still going to look at memory mapping as it will more than likely be faster and more efficient.

Right so it most likely still needs work and checks, but here it is a working version of the original function i posted...

PHP Code:

Function SearchMemory(SearchDLL: hModule; wildcard: Byte; searchCode: Array of Byte; size: Integer) : Pointer;
Const
  UCHAR_MAX = 255;
Var
  scan,lastByte,defaultSkip,pID, searchEnd,SearchSuccess : Cardinal;
  skipLength : ARRAY of Integer;
  dllInfo : TModuleInfo;
  p : pointer;
  pbCurrent: PByte;
  b: Byte;
begin
  //WriteLog('------------------------------------------------------------------------------------');
  
  //WriteLog('SearchMemory: Phase 1 - Builds skip length for chars that are not in search');

  //The first loop builds the skip length for characters that aren't in the searched "string"
  lastByte := size - 1;
  while searchCode[lastByte] = wildcard do Dec(lastByte);

    defaultSkip := lastByte;

  //WriteLog('SearchMemory: Phase 2 - Building skip length');

  //The second one builds the skip length for the characters in the string
  scan := 0;
  for scan:= 0 to lastByte - 1 do
  begin
        if searchCode[scan] = wildcard then defaultSkip := lastByte - scan;
  end;

  if defaultSkip > 1 then defaultSkip := defaultSkip - 1;

  //WriteLog(Format('defaultSkip: %u', [scan]));

  //WriteLog('SearchMemory: Phase 3 - Create Skiplength loop');

  //Is just setting the default skip length
  SetLength(skipLength, UCHAR_MAX);
  for scan:=0 to UCHAR_MAX do
    skipLength[scan] := defaultSkip;

  //WriteLog('SearchMemory: Phase 4 - Searching, skipping bytes based on the skip length');

  //Third loop searches for the string, skipping bytes based on the skip length
  for scan := 0 to lastByte-1 do
  begin
        if searchCode[scan] <> wildcard then
    begin
            skipLength[searchCode[scan]] := lastByte - scan;
    end;
  end;

  if GetModuleInformation(GetCurrentProcess, SearchDLL, @dllInfo, sizeof(dllInfo)) = FALSE then
  begin
    //WriteLog('SearchMemory: Phase 5 - GetModuleInformation failed...');
    exit;
  end
  else
  begin
    //WriteLog('SearchMemory: Phase 5 - Im past GetModuleInformation...');

      p := dllInfo.lpBaseOfDll;
    //WriteLog(Format('SearchMemory: Checking dllInfo.lpBaseOfDll: %p', [p]));

      searchEnd := Cardinal(dllInfo.lpBaseOfDll) + dllInfo.SizeOfImage;
      searchEnd := searchEnd - (lastByte + 1);

    //WriteLog(Format('SearchMemory: Checking StartAddr: %p,  SearchEnd: %08X', [p, searchEnd]));
    //WriteLog('------------------------------------------------------------------------------------');

      while Cardinal(p) <= searchEnd do
    begin
        scan := lastByte;

        while ((searchCode[scan] = wildcard) or (PByte(Cardinal(p)+scan)^ = searchCode[scan])) do
        begin
            if scan = 0 then
            begin
               result := P;
               Inc(SearchSuccess);
               Exit;
            end;
            scan := scan-1;
        end;

        p := Pointer(Cardinal(p)+skipLength[PByte(Cardinal(p)+lastByte)^]);

    end;

      if ( SearchSuccess = 0 ) then
      begin
          //WriteLog('ERROR: Search failed');
              result := 0;
      exit;
      end;

      if ( SearchSuccess > 1 ) then
      begin
      //WriteLog('ERROR: Search returned multiple results');
      result := 0;
      exit;
      end;

    result := 0;
  end;
end;