memory scanner on radare2

[gogo2464]

We can use a memory scanner on cheat engine. The idea is to check any memory change between 2 breakpoints. We can see all variable with a superior value and each with less and each with same value depending of scanner configuration.

It could be fun to do game hacking on radare2. It could be also fine to check if a packer/encryption function has unpacked or decrypt a specific / all the binary

I would like to implement this on r2.

I am very busy these day. Too luch PR to do...

[trufae]

I wrote an issue for this long time ago but seems like it was lost or closed. All the basic features needed for this to be done are already implemented. You can take memory snapshots. Diff them for specific value changes and spot the address. But cheatengine have a better interface for this

[gogo2464]

@trufae great could you tell me some hints about where the basics features are implemented please?

I may need to create a better interface for cheat engine first!

[trufae]

Sure, sorry for the delay, been busy in tons of things. let me elaborate, the cheatengine does the following:

• search for values (or values in range) in memory (the /v command)
• it stores the addresses and their values (this is in the output of /vj laready
• periodically compare these values with the current ones (cx or cv commands does that)

This thing can be written in javascript as a core plugin, without too much work, and i understand this could be an interesting feature to have in core and shuold be also easy to write in C, but i guess most people wnating this would like to have an UI (which can be easily done in the webui frontend of r2), so i let you play with this and pick the option you like the best.

[gogo2464]

Interesting! We must document the /v command in r2book first! The charset plugin is still not documented in the official r2book. Could you tell me why please?

[gogo2464]

It is documrnted but not set online yet.

[trufae]

Because it was not referenced from anywhere. fixed now