scanner

This library provides a mechanism for scanning memory for signatures.

local scanner = require('scanner')

✔️ Dependency Not Required

This library does not require an explicit dependency in the manifest.xml file for your package.

Tables

The signature table has the following entries:

scanner.scan : Scans the game memory for the provided signature.

scanner.scan

Scans the game memory for the provided signature.

Definition

function scanner.scan(signature : string, module : string = 'FFXiMain.dll')

Parameters

signature string

The signature to scan for. It takes a string of bytes in hex representation and allows wildcards in the form of ?? to match any byte. Also allows * and & as special characters to indicate dereference and raw location respectively. See the return section for more details.

module string [default: 'FFXiMain.dll']

The module to scan in.

Return

A pointer (as an FFI cdata object) to the matched signature. By default it returns the address after the matched signature and dereferences it once. The location of the match can be adjusted by placing the * character at other parts of the signature, in which case that point will be returned. & can be used to indicate the address of the match, without dereferencing.

Examples

Looking at this memory table:

         | -E -F -0 -1 -2 -3 -4 -5 -6 -7 -8 -9 -A -B -C -D
----------------------------------------------------------
039B757E | 90 90 83 EC 08 A1 10 41 C6 03 53 33 DB 56 66 89
039B758E | 5C 24 08 66 89 5C 24 0A 66 89 5C 24 0C 66 89 5C
039B759E | 24 0E 8A 50 18 8B F1 8B 48 08 84 D2 79 0A 83 F9
039B75AE | 02 74 09 83 F9 03 74 04 3B CB 74 16 8B 46 08 6A

The following are a list of signatures to scan for and what they would return (assuming this memory region lies in 'FFXiMain.dll'):

scanner.scan('83EC08A1????????5333DB56') -- 245C8966
scanner.scan('83EC08A1????????5333DB56*') -- 245C8966, same as the default
scanner.scan('83EC08A1????????5333DB56&') -- 039B758C, same as the default, but not dereferenced
scanner.scan('83EC08A1*????????5333DB56') -- 03C64110
scanner.scan('83EC08A1&????????5333DB56') -- 039B7586
scanner.scan('&????83EC08A1????????5333DB56') -- 039B757E