Signature generator for Cheat Engine. Right-click any instruction in the Memory Viewer disassembler to copy an AOB signature, a C++ pattern, or the address.
This release also carries everything from 1.0.4, which was never published separately, so it is the full set of changes since 1.0.3.
1.0.5 - Memory & Output
Changed
Wildcards print as * again in the AOB output. Copy C++ Pattern is unaffected and keeps \x00 / ?.
Snapshot buffers are no longer zero-filled. The region was previously held in a std::vector, whose resize() fills the whole buffer with zeros before ReadProcessMemory overwrites it — a pointless memset of the entire .text section and a second pass over every page, on every lookup. It is now a raw array that new[] leaves uninitialised.
Exact allocations in the page-wise fallback. When a region cannot be read in one go, the readable stretches were accumulated with insert(), which can leave the buffer holding roughly twice its content. The pages now go into one buffer and each stretch is cut to size afterwards.
Candidate limit lowered from 1,048,576 to 65,536 addresses. On overflow the scan already reports itself incomplete and the caller extends the pattern instead, so the larger list was never needed — it only cost memory and sorting time.
The thread pool is only built when it pays off. A fresh pool was spawned for every scan, including the very small ones that run dozens of times per signature. Scans below 4 MB now run on the calling thread.
On a synthetic 48 MB section with 22,500 near-identical decoys, signature generation went from about 12 ms to 4-6 ms.
1.0.4 - Snapshot Scanner & Zydis 5
Changed
Zydis updated 4.1 → 5.0.0. Newer instruction tables and decoder fixes.
One-shot module snapshot. All executable regions of the target module are read into local memory once per lookup; every uniqueness check and candidate filter then runs against that snapshot instead of issuing a fresh ReadProcessMemory call per attempt. This is what actually fixed the multi-minute freeze on generic signatures — the earlier candidate-list optimization still re-scanned the whole module per anchor.
Instruction-aligned anchors. Fallback anchors are now real decode-chain boundaries (found by decoding forward once) instead of every byte offset, cutting anchor attempts from up to 1024 to a few dozen.
Full-module scan is multithreaded, split into 2 MB chunks across all CPU cores, with a memchr-based prefilter on the first unmasked byte.
Copy Address Info now asks Cheat Engine's own symbol resolver first, so Mono/IL2CPP methods print as Menu_DevGame:UpdateDesignSettings+f5 instead of a bare hex address; falls back to module+offset, then the raw address.
Fixed
Uncovered/invalid addresses now fail immediately with a clear error instead of scanning the whole module empty-handed on every anchor attempt.
EnumProcessModules buffer could be overrun on processes with >1024 modules.
ReadProcessMemory partial reads (STATUS_PARTIAL_COPY) were discarded outright instead of being accepted where they still covered the needed range.
A generated signature is now re-verified as a whole (exactly one hit, at the expected address) before being emitted; previously an incrementally-built pattern was trusted without a final check.
GlobalFree leak in the clipboard helper when SetClipboardData failed.
Install
Copy the DLL into your Cheat Engine plugins folder, then enable it under Edit -> Settings -> Plugins -> Add new.