[Suggestion]Save memory dump(s), and use it for sub searches

[rogueyoshi]

a similar (but inferior) memory hacking program called ArtMoney features this. its pretty hard for me to explain, but i will try...

basically in artmoney, theres a special kind of searching called "Save a memory dump". you select the data type and address range that you'd like to search for, and the program stores all the results in a memory dump. from there, you can do a "sub search" for additional memory searches. when you are done, you can compare values the values in the memory dump using some formula. for example:

i am looking for the the address that stores the amount of gold. assuming the values aren't encrypted, i save 3 dumps in which the gold value is 30, 53, and 741 respectively. i could then use the formula

Code: Select all

(M1=30)and(M2=53)and(M3=741)

and it would narrow down any values that are equal to what they were in these three states.

btw, formulass in ArtMoney are a logical expression containing:

Other expressions in brackets ()
Arguments (M1,M2, and etc) - States of object (a memory dump or addresses/values recordsets).
A set of arguments M[2,4] - States of object at 2 and 4 steps. For example M1 <> M[2,4] equal like (M1 <> M2) and (M1 <> M4)
Numerals (100,-15,Ah,11.2) - Two numbers can be only in expression like 100>=M1>=300
Text ('Boss',"Good") - only in expression like M1='Boss'
Conditions ( "<",">","=" and etc) - for example M1=1, M2>=100, 1<=M3<=2, or for comparison of the states of the object M1>M2, M1<>M2.
Arithmetical operations ('+','-') - only in expression like M2>=M1+100
Operation AND - Unification of two recordsets of addresses, if address found in 1 and 2 expressions.
Operation OR - Unification of two recordsets of addresses, if address found in 1 or 2 expressions.

[mezzo]

would this even work with software that uses pointers to shovel it's variables around memory ? I'm pretty sure that MHS does lots more then what you describe (but you may have to script search for it)

[L. Spiro]

As mentioned, it is possible to do this manually with Script Searches, though it would not be advisable for the same reasons that I had when I did not add it natively into the project.

The dumps are usually too huge; a problem ArtMoney doesn’t often have because it auto-filters a lot of chunks from the search (improved speed at the cost of sometimes valuable returns).

It is possible to enforce a size limit on the dumps. With that out of the way, the next thing preventing me from adding it natively would be the time/effort vs. benefits. For an addition so large (mind you if I added it myself my expressions/features would be larger than in ArtMoney’s version), I would have to be sure it is useful enough to be used and offers something no other type of search does. Comparing between files is one thing but are the unique features of this completely impossible with the other searches, including Script Search?


L. Spiro

[rogueyoshi]

thats what i was thinking, that the dumps could potentially be insanely huge. well, even if its not natively supported, maybe i can try and emulate that function with the scripting. although with my coding skills, it will definitely be more limited.