CrySearch Memory Scanner v1.17 - Downloads - OldSchoolHack

CrySearch Memory Scanner v1.17 Screenshot

Kategorie: Tools
Entwickler: evolution536
Hochgeladen von: System
Hinzugefügt am: Sa 25. Apr 2015, 14:50
System: Windows

VirusTotal Ergebnis: 1/55

Beschreibung

Bei Problemen mit einem Hack hilft
ein Blick in die FAQ!

Features

Accessing processes remotely, also system processes when running as Administrator;
Memory scanning for primitive types, strings and byte sequences;
Filtering scan results (a.k.a. Next scan);
Supports relative addresses and offsets;
Creating, saving and reusing address tables containing scan results.
Changing values at memory addresses and freeze them;
Viewing PE (Portable Executable) information about the opened process;
Viewing and dumping sections;
Viewing threads, change priority, suspend, resume and create threads remotely;
Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk;
Allocating memory blocks remotely;
Generating code snippets from address tables;
Hotkeys to automate actions that do not require user input;
Viewing import address table of loaded process and its modules;
Settings hooks on the IAT of a process and its modules and restoring export addresses;
Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information;
Viewing and closing handles in the loaded process;
Disassembling executable pages in a process to provide memory view and program flow control;
Walking heaps in the opened process as side feature of the disassembler;
Debugging executable code and data to find out what the flow of a program is;
Plugin system featuring CrySearch extensions to be written in MASM, C or C++;
Generate signatures and byte-arrays from selected disassembly;
Create memory dissections of specific parts of the process' memory and save them to the address table.

FAQ Q: What OS's does CrySearch support?
A: Windows XP and higher. CrySearch is coded on Windows 8.1, and also tested on Windows XP. However, due to limitations of the OS, some features might not work on Windows XP.

Q: I have an issue that is not described in the FAQ. What do I have to do?
A: Refer to CrySearch's Wiki page linked on top of the first post. If you still haven't found a solution to your issue, feel free to post a message. If you do so, please write down your issue as detailed as possible.

Q: Why does the CrySearch user interface have some parts contain oversized buttons and largely spaced text?
A: When you set your windows font size to 125% or 150% the text will outgrow the controls.

Q: I just updated CrySearch and it crashes in random places. What can I do?
A: Some settings CrySearch saves to the xml file it creates may have changed. The structure of the XML file is not correct. This results in undefined behavior. Delete the XML file and restart CrySearch.

Download CrySearch Memory Scanner v1.17

Do 25. Jan 2018, 17:11
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: v3.2: - Changed the Unknowncheats forum link in about dialog to the CrySearch website (Um Links zu sehen, musst du dich registrieren); - Changes to the disassembler: - Fixed bug where not all contents of some memory page would be disassembled by Capstone; - Removed memory page selection control in favor of scrolling from page to page using up and down buttons; - Reverted back to one background thread, threadpools and multiple threads are not necessary. - Fixed bugs in memory scanner, resulting in certain ranges of memory not being searched at all; - Added description of address table entry to memory dissection window where applicable; - Added code cave scanner that identifies nop, int3 and zero sleds, accessible from the Tools menu. Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems; Scanning for code caves of variable sizes in accessible memory pages. Screenshots: Download: CrySearch Memory Scanner - v3.2

Sa 27. Mai 2017, 13:39
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: v3.0: - Slight performance optimizations by eliminating heap allocations; - Added a configurable warning (advanced tab, settings window) for when OriginalFirstThunk is zero: e.g. the application is packed; - Revised the memory scanner for performance and I/O usage: - Changed the disk storage scheme from plain value array to using a bitset and more complex data structure on disk; - Major changes for code size and speed; - Changes resulted in improved search performance, especially for larger scans. - Added a window to view all committed memory page in the target process, with the possiblity to free them (Allocate memory window); - Fixed race condition issue in the caching of search results for the user interface, keeping more results in memory than intended; - Improvements and changes to dumper plugins: - Added a first version of a dumper that dumps a module by enumerating the pages inside the process base address plus size range (needs to be perfected); - Added a signature to dumped files; the signature is placed in the NumberOfSymbols and PointerToSymbolTable fields in the PE header. - Added option (settings window, advanced tab) to show architecture of process in open process window (intrusive, turned off by default); - Added feature for brute-forcing process IDs (PID) to find possibly hidden processes. Available from Tools window: - Tries PIDs from 0 to 65535, and colors processes that were not found in the regular process list red; - Allows opening of brute-forced processes from right clicking. - Fixed a bug where CrySearch fails to retrieve the module list on opening a process that results in an infinite loop; - Some general code improvements that resulted in decreased executable file size; - Refactored hotkey system and added hotkey that toggles freeze/thaw on all address table entries; - Fixed bugs in thread hijacking method for DLL injection where: - If the opened process never communicates back that injection has finished, the injection process would enter an infinite loop; - The first thread was always selected for hijacking. A thread is randomly selected now instead for better compatibility. - Slightly adjusted the CPU information in the about window: sorted chronologically, added CPU brand string and removed VMX; - Fixed bug with routine override functions where deleting a used plugin from the plugin directory and opening the settings window subsequently would crash CrySearch; - Fixed bug where type would be changed incorrectly in the change dialog of an address table entry; - Removed the scan thread priority setting from the settings window; - Changes in the address table: - Removed the frozen parameter from persistent address table storage; - Fixed bug where freezing an address table entry would revert after a few minutes of playing. Screenshots: Download: CrySearch Memory Scanner v3.0

Mi 4. Jan 2017, 23:34
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Screenshots: Download: CrySearch Memory Scanner v2.11

Mo 17. Okt 2016, 20:06
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Screenshots: Download: CrySearch Memory Scanner v2.10

Mo 19. Sep 2016, 13:37
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Screenshots: Download: CrySearch Memory Scanner v2.05

Sa 6. Aug 2016, 02:19
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Features Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. v2.04: - Added feature to NOP out selected rows using right-click menu in the disassembly window; - Fixed a bug in the PE window where the image base of an x64 process would be truncated to 32-bits; - Fixed a bug where freezing and thawing addresses in the address table would not work properly anymore; - Added the possibility to edit multiple selected address table entries at the same time, only by right-clicking and excluding editing the address; - Reduced the timeout for retrieving window icons in the open process window; - Improved the disassembler window: - Added an option to go back to the entrypoint in the toolstrip and the right-click menu; - Added resolving of intermodular function calls to functions in the import address table; - Added heavy parallellism to the disassembler, greatly increasing processing speeds. - Added a threshold to the amount of rows that can be selected for signature or byte array generation. This threshold is set to 256; - Partially added masking for signature generation in the disassembly window. Screenshots: Download: CrySearch Memory Scanner v2.04

Fr 20. Mai 2016, 11:04
DrBlue	Cheatengine++

Do 19. Mai 2016, 15:07
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table; A read-only operation mode which eliminates all writing operations on a process, which is useful for evading anti-cheating systems. Download: CrySearch Memory Scanner v2.03

Mi 9. Mär 2016, 21:08
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table. Screenshots: Download: CrySearch Memory Scanner v2.02

Fr 27. Nov 2015, 00:17
System	Kategorie: Tools Entwickler: evolution536 Beschreibung: Accessing processes remotely, also system processes when running as Administrator; Memory scanning for primitive types, strings and byte sequences; Filtering scan results (a.k.a. Next scan); Supports relative addresses and offsets; Creating, saving and reusing address tables containing scan results. Changing values at memory addresses and freeze them; Viewing PE (Portable Executable) information about the opened process; Viewing and dumping sections; Viewing threads, change priority, suspend, resume and create threads remotely; Viewing, injecting, ejecting, dumping and hiding modules, and restore PE headers from a file on the disk; Allocating memory blocks remotely; Generating code snippets from address tables; Hotkeys to automate actions that do not require user input; Viewing import address table of loaded process and its modules; Settings hooks on the IAT of a process and its modules and restoring export addresses; Viewing PEB and TEB's for loaded process and its threads, including manipulation of certain associated information; Viewing and closing handles in the loaded process; Disassembling executable pages in a process to provide memory view and program flow control; Walking heaps in the opened process as side feature of the disassembler; Debugging executable code and data to find out what the flow of a program is; Plugin system featuring CrySearch extensions to be written in MASM, C or C++; Generate signatures and byte-arrays from selected disassembly; Create memory dissections of specific parts of the process' memory and save them to the address table. Screenshots: Download: CrySearch Memory Scanner v2.01