InitializeSigScan( DWORD PID, const char* Module)
The first parameter is a 32bit unsigned integer, supplying the Process ID you are
wanting to read, and the module to find a memory address in.
This function will connect to the process, find the base address, and if the process is a not the current process, copy the entire module to your programs
local memory. This is required to achieve high speeds of scanning the memory, as doing it over
ReadProcessMemory would be drastically slow.
SigScan(const char* Pattern, int Offset)
This is the primary function of the DLL, that does the actual scanning. You MUST call InitializeSigScan before using this function.
It will automatically scan the last Process and Module initialized with InitializeSigScan().
This function accepts a string ascii based pattern of bytes. You must supply 2 characters per byte
to check for as you normally would define as 0xXX. If its a single 0xF, you need "0f". So the strings length must be divisible by 2,
where every 2 characters represents 1 byte.
Example: "83C408DFE0F6C4050F8A610100005FC605"
This will look for: 0x83 0xC4 0x08 0xDF 0xE0 0xF6 0xC4 0x05 0x0F 0x8A 0x61 0x01 0x00 0x00 0x5F 0xC6 0x05
By default, SigScan will use the next 4 bytes AFTER the end of the signature as the memory address you are wanting to find.
The Offset field is computed into this predefined location. So in most cases Offset should be 0. However, if you find a signature
thats like 36 bytes before your desired memory location, you can set offset to 36 and it will look at 36 bytes AFTER the end of the signature.
Offset will primarily be 0 in your scans, but is provided to you so you can use signatures a little more distant from the desired location
without creating an insanely long signature or using a ton of wildcards.
There are 2 special characters that can be used in the pattern, one is address specification.
As stated, by default the memory address it will return is at the end of the signature. But sometimes you may want to use a few bytes AFTER your
desired memory location as part of your signature. If you wish to do this, you can specify WHERE in your signature your desired
memory location is at with XXXXXXXX,
For example (not a real signature!): "3FBACD300200A1XXXXXXXXB1C4DA"
Now the position of the X's declares where the memory address is. Offset should be 0 when using this, as offset will modify the position,
and will not returned your desired memory location!!!
Any unkown character such as ? and invalid hex characters are treated as wildcards, but still must be matched up in 2's.
For example (not a real signature!): "3AB2DFAB????????DEA1FA"
Sometimes the middle of your signature may have other unwanted memory addresses in them, and you need to wildcard those out to skip them.
Wildcard anything that will potentially be different every time the game opens - that includes ALL memory addresses that you are not trying
to retrieve, otherwise your signature will not be valid the next time the game opens and starts at a different base address.
This function also has special characters that can be used at the start of the pattern to change how it functions.
- ##: If the pattern starts with a ## (eg: "##ABCCDDEE"). This resets the default "return area" to the start of the pattern, and returns the start of the pattern itself (NOT THE VALUE OF THOSE 4 BYTES!).
This will return the memory address of the first byte in the signature.
This is useful for finding actual functions themselves in the module.
- @@: Similiar to ##, this will return the address to the signature itself, but retails its default position at the end of the signature.
This will return the memory address of the next byte after the signature.
This is useful for finding actual functions themselves in the module.
Those however will not help much unless you are using a native language with a DLL loaded into the targets process to access those functions.