Memory Tool

[Cosmo777]

Hello,

I have been using a tool I made to look up data structures recently and wanted to share it with the community. If you find it useful then great if not then thats ok too.

You may required VS 2017 to compile it.

I would advise building it in release mode as the performance is much better. Atm memory is an issue that I am looking at trying to resolve... with very large searched it can take a lot of ram, my pc has 64gbs and it has hit 30gbs on very large operations.

I would also caution that going further than 2 levels deep can take a very long time.

Basically you can add multiple memory addresses in different tabs, scan for a value that is a child of that address, specifying how how pointer levels deep to scan.

Then once you have scanned a few addresses and found values you can hit match.

Match will iterate through each of the open tabs and look for values that were a match for what you were looking for, then it will scan the next tab and do the same only keeping values if the match was correct in both tabs. This will repeat for each of the tabs.

Example: I want to find if an item is corrupted. I suspect this is located from the base component of a poe entity.

1. I find the address of 4 base components from poe entities 2 of which are corrupted and 2 which are not.
2. I add 4 tabs to the spider and set the address to the address of each of the base component addresses.
3. I set the value to 0 for the non corrupted tabs and 1 for the corrupted ones, I also set the data type to byte.
4. I hit search on each of the tabs.
5. I hit the find matches, which gives me 2 pointer trails, one trail is 216 the other is 256-416. So 216 is a direct offset from the base component, 256-416 is a pointer and then a direct offset from that pointer.
6. I know that for all of those items 216 and (256-416) matched the 0 or 1 respectively for what i searched for and I am confident that is hhow I find the corrupted value in memory. (in this case 256-416 was also wrong as it wasn't correct for unqiues)
7. I have my offset or pointer trail offset for what I was looking for pretty easily.

There is also a samples directory in the repo, can can load those to see results how matching works.

GitHub - cosmo777/DataSpider: Tool for crawling data structures

Thanks,
Cosmo