AOBScanModule

[Frouk]

Code: Select all

unregisterLuaFunctionHighlight('AOBScanModule')

function AOBScanModule(symbol, mod, aob)
	if not getAddress(mod) or not getModuleSize(mod) then
		error("Module is invalid!")
		return nil
	end
    local startAddress = getAddress(mod)
    local endAddress = startAddress + getModuleSize(mod)
    local result = nil

    local ms = createMemScan()

    local AOB = aob
    if (type(aob) == "table") then
        AOB = ""
        for i, v in ipairs(aob) do
            AOB = string.format("%s %X", AOB, v == nil and "??" or v)
        end
    end

    ms.firstScan(soExactValue, vtByteArray, nil, AOB, nil, startAddress, endAddress, "", fsmNotAligned, '1', true, false, false, false)
    ms.waitTillDone()
	
	local fl = createFoundList(ms)
	fl.initialize()

    if (fl.Count == 0) then
        fl.deinitialize()
        ms.destroy()
        fl.destroy()

        return nil -- no results
    end

    if (fl.Count > 1) then
        if (symbol) then
            print("Cannot register symbol, found more than one matches")
        end
        result = {}
        for i = 0, fl.Count - 1 do
            result[i] = fl.Address[i]
        end
    else
        if (symbol) then
            registerSymbol(symbol, fl.Address[0])
        end
        result = { [0] = fl.Address[0] }
    end

    fl.deinitialize()
    ms.destroy()
    fl.destroy()

    return result
end

registerLuaFunctionHighlight('AOBScanModule')

The function returns a table containing addresses of the matched sequences of bytes, or nil, if it didn't found any
Searches AOB in modules, the usage is simple:

Code: Select all

local aob = AOBScanModule(nil, "game.exe", "48 8B 41 10 48 2B C3")
if (aob) then writeBytes(aob[0], {0x90, 0x90, 0x90, 0x90}) end
-- If we have more than 1 result
for i = 0, #aob do 
	-- writeBytes(aob[i], ...)
end

But be careful, if you are not going to save the table, the addresses will be lost, and there's would be no way to restore them unless you restart the application(or scanning for patches in memory viewer and then restoring them), which might get annoying
And the provided symbol won't work if you have more than one matches, even if you've passed the symbol to the function and it found more than one matches, it will inform you that the symbol cannot be registered
If the AOB is unique(only one match), it will register the symbol