Auto Assembler:aobScanModule

From Cheat Engine
Revision as of 16:33, 22 April 2022 by Chris314 (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Auto Assembler aobScanModule(SymbolName, ModuleName, AOBString)

Scans the memory used by the module ModuleName for a specific byte pattern defined by AOBString and sets the resulting address to the symbol SymbolName.

Note: AOBString definition is composed by a list of one or several bytes optionally separated by spaces. Each byte definition has 2 variants:

- A group of 2 characters, where the first character is the high order nibble and the second is the low order nibble. Each character can be an hexadecimal digit (from '0' to 'F') or a wildcard character (interpreted as any hexadecimal value from 0 to 15)

- An unique wildcard surrounded by spaces (interpreted as any value from 0 to 255)

The wildcards are defined by any of these 3 characters: 'x', '?', or '*'. Some valid patterns:

5x 48 8D 6x 24 E0
5? 48 8D 6? 24 E0
5* 48 8D 6* 24 E0
xx 48 8D xx 24 E0
?? 48 8D ?? 24 E0
** 48 8D ** 24 E0
x 48 8D x 24 E0
? 48 8D ? 24 E0
* 48 8D * 24 E0

Tip: One can use for ModuleName the variable $process defined as the current open process.

Command Parameters

Parameter Type Description
SymbolName string The symbol name to define if AOBString is found
ModuleName string The name of the module to scan in
AOBString string The byte pattern, as hex, to scan for


Examples

aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 53 48 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 xx xx 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 x x 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ** ** 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 * * 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ?? ?? 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ? ? 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 5* 48 *D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00xx8D6424E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00**8D6424E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00??8D6424E0)
aobScanModule(SomeSymbol, $process, 00 1? 8D 64 24 *)

See also

Related Commands