Memory Scanner

Scan Types

Data Types

AOB supports wildcards with ?? (e.g., 48 8B ?? 90)

Scan Regions

• • All — Scan all committed memory
• • Heap — Private memory regions
• • Stack — Thread stack regions
• • Image — Loaded modules (.exe, .dll)
• • Mapped — Memory-mapped files
• • Private — Private allocations only

Features

• • Value writing — Select a result and write a new value
• • Inline editing — Double-click to edit values directly
• • Pagination — 500 results per page
• • Context menu — Edit Value, Copy Address/Value, Install EPT Hook

How It Works

The memory scanner uses the hypervisor to perform physical memory access:

1. Get target process CR3 (page table base)
2. Walk page tables to translate virtual → physical addresses
3. Read/write physical memory via EPT
4. Bypasses Ring 0 memory protections

Usage

1. Navigate to Memory Scanner tab
2. Select a process from the dropdown
3. Choose data type and scan type
4. Enter value to search for
5. Click First Scan
6. Use Next Scan to refine results
7. Double-click or right-click results to modify values

IOCTLs