MemRE

MemRE has a pointer scanner built in. The pointer scanner does have some limitations, but I will expand on this in upcoming releases. For more information on the limitations, please see: 𝐝𝐨𝐜𝐬/𝐦𝐚𝐢𝐧_𝐢𝐧𝐭𝐞𝐫𝐟𝐚𝐜𝐞

Some benefits of MemREs Pointer Scanner are;

• More Consistent chains between restarts to choose from faster than a traditional pointer scanner. This means you can build tables faster and more efficiently.

• MemRE validates chains by brute forcing a comparison along the chain from the base to the dynamic address only showing valid chains.

• In the first release of MemRE, you will have the benifit of Unreal Engine support. This means MemRE will do the dirty work and automatically find the best base address that will keep your pointers alive restart after restart, and if the game is updated, MemRE can find the new base address simply by attaching to the game.

Some of the downfalls of MemREs Pointer Scanner are;

• You need to have a base address to use the pointer scanner. Currently, Unreal Games are supported, and the base address will automatically be found. However, until later updates, it will be expected that you find your own base address to scan from.

• Because of the validation process and little optimization of the pointer scanner, scans can take longer when scanning bigger max depths of chains. I have plans on fixing this issue in future updates.

The structure of a MemRE pointer chain is as follows. 

BaseAddress,Pointer1,Pointer2,Pointer3,etc...

Each pointer is separated by a single comma.

Pointer Scanner Tutorial

Below is a brief tutorial on how to complete a pointer scan with MemRE. 

In this demo I'll be using "Cinemaster Cinema Simulator" and branches off from the tutorial 𝗱𝗼𝗰𝘀/𝘀𝗰𝗮𝗻𝗻𝗶𝗻𝗴.

Now we have found a good dynamic address we can use, let's bring our focus to the "Pointer Scanner" box on the main UI.

As you will see off the bat, the base address (Base Addr:) and dynamic address (Dyn Addr:) are already filled in. The base address is filled in because I'm attached to an Unreal Engine Game, and MemRE has already found the base address, and the dynamic address is filled in because I clicked the "Dollars" entry in the Table List (simply clicking a entry will autofill the field).

To verify an Unreal Engine game is attached besides the base address automatically filling in, you can check the logs.

Speaking of the logs, we also see:

 +Scanning for Base‑Offset candidates…

 +Found 28 Possible Offsets

 +Press Auto to view..

This is MemRE automatically resolving the beginning pointer chain that will make scanning pointers even easier. Lets check that out by clicking "Auto"

A new window will prompt, displaying the starting offsets of the resolved base address, and assign meaningful names to them by fetching them from the GNames/FName pool Unreal Engine generates. 

I have highlighted the best positional pointers i know of from experience, but every game will give different results. From my experience the good stuff is in "BP_GameMode", "BP_GameState", and "BP_GameInstance". They seem to offer the most stable results. Lets try +150 BP_InGameGM_C (which is "BP_GameMode") (PS, for those who don't know BP stands for BluePrint).

Double clicking +150 BP_InGameGM_C will add 150 to our Positional Pointer list. (Note, a positional pointer is not required, but helps)

You can also add more pointers to the Positional Pointer list by typing in a number into the text box, then clicking "Add". Likewise, you can delete any pointer by highlighting one in the list, and pressing "Del" (future updates will allow you to edit the pointers in the current position as well). This is handy if you already found a good pointer chain to something like "Ammo", and you expect the "Health" is part of the player class, you can tell the scanner to follow the pointer chain you already know works from your previous scan, speeding up your scan time even more. 

Now we have all the criteria for the pointer scanner to function correctly. The last thing is to choose the max depth. By default its 3, I'll change it to 4 then ill hit "Scan" and wait for it to finish (Note, the higher the max depth is, the longer the scan will be). 

When the scan is finished (only took 20 seconds for me), a save window will prompt. Give your pointer table a name, I named mine "DemoPointers.MPTR". Just know the .MPTR must stay as .MPTR. If you change it, MemRE cannot open the file.

After you save the file, you can check to see the pointers you have found by clicking the "View PTRs" button. This will trigger a prompt to load a pointer table in, select the pointer table you just saved and the Pointer Table Window will prompt.

Now, I was able to get 13 results (this is one of the perks, you don't have to deal with millions of results) but the values are all set to 0. We know the value should be 9999, and we know the value should be a double. The reason its showing 0, because we need to reflect the correct value type (double). Lets do that now.

Now that's done, we see the correct value (Side Note: you can hover over the value types without choosing one and the values will update in the list giving a preview of that value with that type). Now, We can customize this if we want.. If we know chains are invalid and not showing numbers (Values will automatically update as they change in memory), we can delete any entry right away by either right clicking >> Delete or clicking the entry and pressing Delete on the keyboard (Note, you can highlight and delete multiple if needed). IF you do make these changes, you must save the table by clicking the "Save Pointer Table". This will update any changes you may have made. We aren't going to do this, because all the entries are valid in this demo.

Next, ill close the game and reboot it so we can rescan the pointer table to see if anything has changed. 

(time laps)

I have rebooted the game attached, and ready to test to see what pointers survived through a restart. Focusing back on our Pointer Scanner box on MemRE, I'm going to click the "Scan From File" check box.

As soon as you click the box, a load file box will prompt, load up your table again, then hit "Scan"

This scan will happen quick, its only testing to see if the chain is walkable. In my case, all 13 pointers are walkable!

If you have chains that are invalid, pressing "Yes" will prompt to save a new pointer table that doesn't include the invalid chains.

Now, lets check the chains to see if the values are still valid. Click "View PTRs", load in your updated pointer table and set the correct value type again.

All my chains are good, still pointing to the correct place in memory. I'm going to add the first chain on the list to my Table List. 

To add a pointer chain, simply double click the entry, and it will automatically add the chain to your Table List.

Now that the new pointer chain is added, we can delete our old first dynamic address, rename our new pointer and save our table!

We can verify the new pointer chain by double clicking the address of the entry and viewing the contents.