Can't find array of bytes in 64 bit UE4 game.

Here's the array of bytes I'm trying to find(they stay static all the time):

Here's the code:

private void Button_Click(object sender, EventArgs e)
		{
			long foundAddr = m.AoBScan("0x0", 0x7FFFFFFFFFFFFFFD, "AF 04 00 00 B0 04 00 00 05 00 00 00 00 00 00 00").Result;
			MessageBox.Show("I found the address! Here it is: " + "0x" + longToHex(foundAddr));
		}

		public static string longToHex(long Dec) // Convert long to hex
		{
			return Dec.ToString("X");
		}

And here's what I get:

But when I search for smaller array of bytes "AF 04 00 00 B0 04 00 00":

		{
			long foundAddr = m.AoBScan("0x0", 0x7FFFFFFFFFFFFFFD, "AF 04 00 00 B0 04 00 00").Result;
			MessageBox.Show("I found the address! Here it is: " + "0x" + longToHex(foundAddr));
		}

It does find this array of bytes, but in completely other location:

I also tried to do it like this, using async and await:

private async void Button_Click(object sender, EventArgs e)
		{
			long foundAddr = await m.AoBScan("0x00000000", 0x7FFFFFFFFFFFFFFD, "AF 04 00 00 B0 04 00 00 05 00 00 00 00 00 00 00");
			MessageBox.Show("I found the address! Here it is: " + "0x" + longToHex(foundAddr));

Results are exactly the same as on 2 previous screenshots.

Program has admin rights, I edited app.manifest file. I also unchecked "Prefer 32 bit" in project properties, just as it is suggested on Wiki pages.

I can read and write memory with no problems, using:
m.writeMemory("0x" + longToHex(Addr), "byte", IntToHex(valToSet));

What am I doing wrong here? How can I make it work?

Hi, If we using FreezeValue function our app will start using a lot of CPU resources(on my i5-8400 more than 50%).
Im enclosing the screenshot and counting on a fast fix :)

AoBScan function was updated, but the function comments were not. Could you shortly explain the usage of the parameters
"string code" and
"long end"

thx

if code like "m.readByte("base").ToString()" there will be an error. Seemed read "Base" failed.
m.readByte("base+1").ToString() just fine.

ps:Can you make some exampls about AoBScan fun usage in your Game-Trainers.
I tried "long myAoBScan = (await MemLib.AoBScan("?? ?? ?? ?5 ?? ?? 5? 00 ?? 00 00 00 ?? 00 50 00")).FirstOrDefault();" in my code but just failed.
Thank you so much.
Good day!

I'm just trying to search an array of bytes. It always results in a System.AggregateException. Reading and writing inside the hooked applications memory works fine. Searching the AOB manually with Cheat Engine get the estimated result.

Here is my code:
long x = memory.AoBScan("base", memory.procs.MainModule.ModuleMemorySize, "74 1D 8A 54").Result;
Also tried to run this as an new thread and using the await keyword.
The wikisite for aobscanning seems to be outdated. It's using the old MemLib function.

I'm using NetFramework 4.5 and Memory.dll v1.2.15 from NuGet Packages. My application runs with admin privileges.

Here is the full exception;
System.AggregateException HResult=0x80131500 Message=at least one error occurred Source=mscorlib StackTrace: at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions) at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification) at MoneyHack.Program.findAddress() in J:\csharp\MoneyHack

What i'm doing wrong?

I was surprised string read/write doesn't have any specified length, but even just a generic read/write would work fine. Any chance of adding something like this?

Might already be done, just needs to be tested.

If I write:
long AddrDesync = MemLib.AoBScan("base", MemLib.procs.MainModule.ModuleMemorySize, "Desync", codeFile).Result;
it throws me an exception:
FormatException: Additional non-parsable characters are at the end of the string.

codes.ini
[codes]
Desync=6C 6A ?? 0? ?? F? FF FF ?? ?? 00 00 ?? ?? ?? 00 ?? 00 00 00 ?? ?? ?? 41 ?? 00 00 00 ?? 0? 00 00 ?? 0? 00 00 ?? ?? 00 00

Ok. So I tried to write this memory for this game called Growtopia. It is just a stupid online game for I can practice c# memory manipulation on. When I try to OpenProcess() it says the process does not exist (returns false) but the GetProcessIDFromName() function is returning some numbers.

Please help

Best regards Petr Gardas

I apologize for posting this here but I couldn't find a way to contact you.

Are you planning to add the ability to execute ASM scripts similar to how cheat engine allows you to?

I got error when i write memory
"Object reference not set to instance of an object"

This my code

Public Mem Memori = new Mem()
Private void Form1_load(object sender, eventarg e)
{
Memori.OpenProcess("RF_Online.bin")
Memori.writeMemory("base+0x025A631C,0x096", "byte", "0xff")
}

public Task<IEnumerable<long>> AoBScan(long start, string search, bool writable = false, bool executable = true, string file = "");

public Task<IEnumerable<long>> AoBScan(string moduleName, string search, bool writable = false, bool executable = true, string file = "");

public Task<IEnumerable<long>> AoBScan(string start, string end, string search, bool writable = false, bool executable = true, string file = "");

Being able to provide the module name as a parameter, so the search will be on the module's region, and also being able to provide just the start or provide the start and end as strings(where I can type module names, or module+offset, etc).

Hi Erfg,

Thank you for making this great project and I'm right now having issue when read string from 64 bit system. The function I'm using is readString(string code, string file), which seems to only can be fed in 32bit address. Would it be possible to update it to support fed in 64bit address?

Regards,
ccorzlol

I need someone to test if there are any crashes in the AoB scan function after commit 3421b38

When doing a full range scan 0x00000000, 0x07FFFFFFF the amount of RAM used by the trainer scales up to 2Gb, then, when the scan is done, it returns to 30Mb. Is that normal?

Well, I'm already a longtime user of your memory manipulation DLL, and currently I can say that it's almost perfect, only one detail is missing from it, the option of writing and reading memory in the Big Endian type, the types that are missing from the DLL are:

2 Bytes Big Endian
4 Bytes Big Endian
Float Big Endian

Could you create a function for each type of this, both for reading and writing ?

It would be a very interesting addition to your DLL, well, for sure you will ask, but why the hell do i need to add Big Endian to my DLL, the answer is simple, there are some emulators that use the Big Endian type, as well as the PS3's RPCS3 and Wii U's Cemu, if you can add these functions to your DLL, I would be very grateful, me and everyone who uses your DLL in RPCS3 and Cemu games.

CheatEngine also has the "registersymbol" feature.
how can I add "registersymbol" and how can I get this adrese?
I use "CreateCodeCaves" feature, but how can I do it here?

mov eax,edx

I need to reach my "eax" value.

Thanks for the useful guide, man.
I've finally managed to get it working, and also added in a few of my own new editions to the code.

While this may not be an issue specifically, I'd really like to know what to do about integrating the Memory.dll (into) the assembled finished build at the end of a project, so that you don't need to include the Memory.dll seperately; alongside the .exe application.

I've also tried "ILMerge", but with no success.

Please can you explain if it's possible to do this? Much appreciated. Thanks!

Resolved with ILMerge GUI!

Title says the basis, no current support

Currently requires .NET framework. Can we make this work for .NET core or make a second version for .NET core?

hi my aobscan always return 00000 i don't know why

this is my function
long fuel = m.AoBScan("0x00000000", 0x7FFFFFFF, "?? ?? ?? ?? 0A D7 A3 3E 66 66 06 40 85 6B 80 3F A0 77").Result;

i have try
long fuel = m.AoBScan("0x03000000", 0x70000000, "?? ?? ?? ?? 0A D7 A3 3E 66 66 06 40 85 6B 80 3F A0 77").Result;
but same result can some one help me ?

Mem memLib = new Mem();

memLib.OpenProcess("MyGame");

speedAddr = memLib.AoBScan("0x15000000", 0x10000, ("C7 C7 20 32 02 00 00 00 ?? ?? ?? ?? 5D 5E 89 EB")).Result;

Used to work fine on previous versions of memory.dll.

I receive an unhandled exception:
System.OverflowException: Arithmetic operation resulted in an overflow.
at System.IntPtr..ctor(Int64 value)
at Memory.Mem.d__116.MoveNext()

hi, Aobscan in Memory version 1.2.17 error scan,
I use version 1.2.3 for accurate results and I use Cheat engine and give the same result as version 1.2.3.
But i did not find the results using version 1.2.17
You can fix it, please.

int pid = m.getProcIDFromName("SO2Game");
bool openProc = false;
 if (pid > 0) openProc = m.OpenProcess(pid); 
var adrr = m.AoBScan("38 12 72 00 27 27 00 00 ?? 00 00 00 2C 01").Result;
Debug.Write(adrr.Any());

Output: False

why not true ?
I tried the source from GitHub and the nuget package
Please help me!

Cheat Engine Scan:

Use Version 1.2.3 with Visual studio 2017: The results are very accurate

But Version 1.2.17, result is null, If addr.Any() returns false

title says it. Sometimes modules may be uppercase.

Okay so I tested the 32Bit AoBScanning on multiple Machines and on some it worked just fine and on some it threw a Overflow Excption.

Here is the used test Code:

MemLib.OpenProcess("Test32BitProcess");
var adr = MemLib.AoBScan("D9 40 30 D9 05 ?? ?? ?? ?? DF F1 DD D8 77 1D 8B 43 18").GetAwaiter().GetResult() + 0x9;
Console.WriteLine(adr);
if(MemLib.writeMemory(adr.ToString("X"), "bytes", "0x90 0x90")) {
Console.WriteLine("Success");
}
Console.WriteLine("Done");

The build Configuration was:
Platform: Any CPU
Preffer 32 Bit: Yes
Framework: .Net Framework 4.7.1

I'm trying to write memory to process with
MemLib.writeMemory("Minecraft.Windows.exe+1FC2490", "string", "Noclip");
When I search for 'noclip' in cheat engine i get Minecraft.Windows.exe+1FC2490 with string value 'noclip' and when I change it to Noclip it enable noclip, but when I do it in memory.dll it's not working

Here's how I get the process
`int gameProcId = MemLib.getProcIDFromName("Minecraft.Windows");
if(gameProcId != 0)
{
loaded = true;
if (!MemLib.OpenProcess(gameProcId.ToString()))
{
MessageBox.Show("Fail");
}
else
{
MessageBox.Show("ok");
}
label1.Text = "Process ID: " + gameProcId.ToString();

        }
        else
        {
            MessageBox.Show("not found");
        }`

https://media.discordapp.net/attachments/721297244564881430/724321182010048602/unknown.png

Can't write to the address.

Imports Memory
Public Class Form1
Private Async Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
Dim m As New Memory.Mem
Dim pid = m.getProcIDFromName("main")
MsgBox(pid)
Dim openproc = False
If pid > 0 Then
openproc = m.OpenProcess(pid)
End If
Dim addr = Await m.AoBScan("?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 40 C0 00 00 40 C0 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00")
MsgBox(addr(0))
End Sub

Private Async Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click

End Sub

End Class

Is there any way to make the "??" mask return only values higher than "0"? That's because I have some values in my AoB that keeps changing randomly but their values are always higher than 0, but when I use "??" mask, I get thousands of results where "??" is replaced with 00, if it only accept values higher than 00 it would return only one result.

btw, thank you for this awesome project!

            if (openProc)
            {

                int charid = memread.readByte("TekkenGame-Win64-Shipping.exe+0x33FE0E0,0x10,0x38,0x0,0x0,0x14");
                MessageBox.Show(charid.ToString());

                if (charid.ToString("X") == "09")
                {
                    MessageBox.Show("Got value " + charid.ToString("X"));
                }
                else
                {
                    MessageBox.Show("Value not known");
                }
            }

Does anybody know why it always returns 0, when it should be 9?

MemLib.AoBScan("sao_hr.exe+20000000", 40000000, "32 189 160 10 1");
MemLib.AoBScan("sao_hr.exe", 40000000, "32 189 160 10 1");
MemLib.AoBScan("sao_hr", 40000000, "32 189 160 10 1");
MemLib.AoBScan("140000000", 40000000, "32 189 160 10 1");
MemLib.AoBScan("0x140000000", 0x40000000, "32 189 160 10 1");
MemLib.AoBScan("sao_hr.exe", 0x40000000, "32 189 160 10 1");

The exception is thrown all over it

64 bit game
MemLib.AoBScan("0x140000000", 0x40000000, "32 189 160 10 1");
MemLib.AoBScan("0x140000000", 0x40000000, "20 BD A0 0A 01");
throw exception uint32 too small
Am I using it wrong?

@erfg12

Hello,

I already wanted to congratulate you for your project which allowed me to understand how to create a trainer.

I allow myself to contact you because I am developing a Trainer for the game Dying Light Enhanced Edition and I am stuck in my development because I can not allocate memory in the process.

Below is the way I proceed to work on modifying the memory.

I start by looking in memory, HEX values F3 0F 11 83 54 09 00 00 40

// Variable
private Task<long> ResultatOneKill = null;
private Mem m = new Mem();

ResultatOneKill = m.AoBScan("0x700000000000", 0x7FFFFFFFFFFF, "F3 0F 11 83 54 09 00 00 40");
if (ResultatOneKill.Result > 0)
{
    // Convertion of the value of ResultatOneKill.Result in usable address for m.writeMemory ( a value of type long => (140717704298565) to a value string => (0x7FFB64C74045)

    string sAdresse = String.Format("{0:X2}", ResultatOneKill.Result);
    if (chkInfiniteHealth.Checked)
    {
         // Modification of the memory values ​​to the address indicated in the sAddress variable.
         m.WriteMemory(sAdresse, "bytes", "0x2F 0xF0 0x76 0x2B 0x41 0x0F 0x28 0xC0 0xEB 0x28 0x48 0x8D 0xBB 0x38 0xF7 0xFF 0xFF 0x83 0xCA 0xFF 0x48 0x8B 0x07 0x48 0x8B 0xCF 0xFF 0x90 0x48 0x01 0x00 0x00 0x90 0x90 0x90 0x73 0x05 0x0F 0x28 0xC7 0xEB 0x08 0x0F 0x2F 0xF0 0x72");
    }
    else
    {
       m.WriteMemory(sAdresse, "bytes", "0x2F 0xF0 0x76 0x2B 0x41 0x0F 0x28 0xC0 0xEB 0x28 0x48 0x8D 0xBB 0x38 0xF7 0xFF 0xFF 0x83 0xCA 0xFF 0x48 0x8B 0x07 0x48 0x8B 0xCF 0xFF 0x90 0x48 0x01 0x00 0x00 0x0F 0x2F 0xF7 0x73 0x05 0x0F 0x28 0xC7 0xEB 0x08 0x0F 0x2F 0xF0 0x77");
    }
}
else
{
    MessageBox.Show("Erreur, plage mémoire non trouvée", "Erreur", MessageBoxButtons.OK, MessageBoxIcon.Error);
}

When I do the test with Cheat Engine, I see that it changes memory area ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? replace it with this C7 83 54 09 00 00 00 00 C8 42 E9 C0 7C 63 02 90 90 90 90 90 90 90 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

And that's what I can not do in my program.
I copy you below the content of the script Cheat Engine in case it allows you to better understand my problem.

[Enable]

alloc(ih_1,128,gamedll_x64_rwdi.dll) //Infinite Health
aobscanmodule(ih_aob1,gamedll_x64_rwdi.dll,F3 0F 11 83 54 09 00 00 40)
registersymbol(ih_aob1)
label(returnhere_ih_1)

//Infinite Health - 2nd Compare
aobscanmodule(ih_aob2,gamedll_x64_rwdi.dll,FF 90 48 01 00 00 0F 2F F7)
registersymbol(ih_aob2)

//--------------------------------------------------//
ih_1:
mov [rbx+00000954],(float)100
jmp returnhere_ih_1
//--------------------------------------------------//

ih_aob1:
jmp ih_1
nop
nop
nop
returnhere_ih_1:

ih_aob1-B:
db 72 03

ih_aob2+6:
db 90 90 90

[Disable]

ih_aob1:
db F3 0F 11 83 54 09 00 00
unregistersymbol(ih_aob1)
dealloc(ih_1)

ih_aob1-B:
db 77 03

ih_aob2+6:
db 0F 2F F7
unregistersymbol(ih_aob2)

Thank you in advance for your help

Regards,

Frank

I'm currently trying to make a game trainer, but the game stores all of it's variables as doubles. This is fine for writing because I can set the value to double, but I am unable to read the memory because there is no readDouble function. Mind adding it?

NOTE: Try using C++ dll with named pipes to send ASM in string format, and parse in C++ to real ASM, then execute the function.

Everything in my project kept exactly the same but only updating the version of memory.dll I'm facing issues:

As per the title:

1.2.15 - works perfectly
1.2.16 - with any "Get" memory method I get an internal exception "ConfigurationErrorsException: Unrecognized configuration section requestedExecutionLevel."
1.2.17 - I get no error but all values returned are 0. IsAdmin is true which tells me admin privs is working fine.

I'm running with admin privs and as mentioned the only thing that's changing in my project is the memory.dll version. Basically I just want to use the new overload of AoBScan to return more than one address.

What could be the problem? Thanks

This is how I try to call your .dll

private async void button3_Click(object sender, EventArgs e)
		{
			Mem m = new Mem();
			int processId = Process.GetProcessesByName(comboBox1.Text).FirstOrDefault().Id;

			if (m.OpenProcess(processId))
			{
				this.Text = "Scanning ...";

				Task<IEnumerable<long>> task = m.AoBScan(richTextBox1.Text.Trim());
				var result = await task;
				m.closeProcess();

				foreach (long address in result)
				{
					dataGridView1.Rows.Add(address);
				}
			}
			else
			{
				MessageBox.Show("Could not openprocess!");
			}
		}

The inner exception shows this

The process ID is not empty, and the pattern is also not empty.
I run the program as administrator etc.

Hopefully I am just doing something wrong, love your project eitherway!

thanks alot for this tool ,
its really helpful
could you please put a code for AOBSCAN in VisualBasic.net?

Hi there. When I use the AoBScan to scan for a mask (the world pointer), it throws me an IndexOutOfRangeException.

long WorldPTR = memory.AoBScan("48 8B 05 ? ? ? ? 45 ? ? ? ? 48 8B 48 08 48 85 C9 74 07").Result.First();

I tried
long WorldPTR = (await memory.AoBScan("48 8B 05 ? ? ? ? 45 ? ? ? ? 48 8B 48 08 48 85 C9 74 07")).Result.First(); as the examples says but it gives error saying it's not an asyncronous task. HEEEEELP.

Can you make lib for x64 game?

I'm running into an issue when trying to use the library to access an address like:
"base.PrintScriptCallstack+0x57BAC"

It appears to return the same results as:
"base+0x57BAC"

Is this expected behavior? Or am i doing something wrong?

I wanted to scan this array of bytes on address '1AAAA2EE82C'

So I set the start address to 0x50000000 and range to 0x30000000000.
If it works well, it should search 0x50000000-0x30050000000.

But when I checked debug strings, the range that I set and the range that it actually scanned was diffrent.
(The scan worked well when I tried same thing with 32-bit address.)

I even unchecked the 'prefer 32bit' on build setting.
How do I get it to scan the same range as I entered?

This part: https://github.com/erfg12/memory.dll/blob/master/Memory/memory.cs#L1167

Also, check OpenProcess to support .bin processes.

https://github.com/Akaion/Bleak/blob/d8919509d57c720646374f9e9e33586e3362f0c6/Bleak/Injection/Methods/LdrLoadDll.cs#L97

i'm probably doing something wrong

 var x = mem.AoBScan("6D 3A 2F 2F 75 72 6C 2F 53 74 65 61 6D 49 44 50 61 67 65 2F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??").GetAwaiter().GetResult();
Console.WriteLine(x);

System.Linq.OrderedEnumerable2[System.Int64,System.Int64]`

My code was working well with memory.dll, then I tested it after 3 days and it throw error
It happens when I try to write into process
System.NullReferenceException: Object reference not set to an instance of object. v Memory.Mem.get64bitCode(String name, String path, Int32 size) v Memory.Mem.getCode(String name, String path, Int32 size) v Memory.Mem.writeMemory(String code, String type, String write, String file) v Cli3nt_Mars.Form1.checkBox1_CheckedChanged(Object sender, EventArgs e) v System.Windows.Forms.CheckBox.OnCheckedChanged(EventArgs e) v System.Windows.Forms.CheckBox.set_CheckState(CheckState value) v System.Windows.Forms.CheckBox.OnClick(EventArgs e) v System.Windows.Forms.CheckBox.OnMouseUp(MouseEventArgs mevent) v System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks) v System.Windows.Forms.Control.WndProc(Message& m) v System.Windows.Forms.ButtonBase.WndProc(Message& m) v System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
I'm pretty sure my code is 100% correct! It worked for other people, but for me it just stopped working and process where I'm writing is running.. So I think It's caused by my windows, so what should I do to make it working again?

32bit scanning with the aob, issue is the IntPtr is only for signed int and the max memory range for a 32bit process is unsigned Int
changing from IntPtr to nonCLS compliant UIntPtr would work or instead of using long or ulong etc using unsafe void*

Basically this: https://github.com/dotnet/coreclr/issues/4062

• Quote from Hollow87

Hi,

I made this little code:

Process p = Process.GetProcessesByName("WWAHost")[0];
Mem mem = new Mem();
Console.WriteLine(mem.OpenProcess(p.Id));

But it always display 'false' in the console.
I tried with other process but it doesn't work too.
I launched the program with administrator rights.

I'm on Windows 10.

Thanks in advance,

This doesn't work in memory.dll

"base+0x12F5110,0x10,-0x26E20"

hero snowman - I get exception

i see project code
https://github.com/erfg12/memory.dll/blob/master/Memory/memory.cs
mainModule = theProc.MainModule;

if in 64 is error "A 32 bit processes cannot access modules of a 64 bit process"