-
Notifications
You must be signed in to change notification settings - Fork 14
Accessing Memory
Jamiras edited this page Sep 26, 2025
·
11 revisions
The following built-in functions are provided for accessing memory:
-
byte(address)- the 8-bit value at the specified address -
word(address)- the 16-bit value at the specified address -
tbyte(address)- the 24-bit value at the specified address -
dword(address)- the 32-bit value at the specified address -
bit0(address)- the least significant bit of the specified address -
bit1(address)- the second least significant bit of the specified address -
bit2(address)- the third least significant bit of the specified address -
bit3(address)- the fourth least significant bit of the specified address -
bit4(address)- the fifth least significant bit of the specified address -
bit5(address)- the sixth least significant bit of the specified address -
bit6(address)- the seventh least significant bit of the specified address -
bit7(address)- the most significant bit of the specified address -
bit(index, address)- theindexth bit of the specified address (indexmust be between 0 and 31) -
low4(address)- the four least significant bits of the specified address -
high4(address)- the four most significant bits of the specified address -
bitcount(address)- the number of non-zero bits at the specified address -
word_be(address)- the 16-bit big-endian value at the specified address -
tbyte_be(address)- the 24-bit big-endian value at the specified address -
dword_be(address)- the 32-bit big-endian value at the specified address -
float(address)- the 32-bit IEEE-754 floating point value at the specified address -
float_be(address)- the 32-bit IEEE-754 big-endian floating point value at the specified address -
mbf32(address)- the 32-bit Microsoft Binary Format floating point value at the specified address -
mbf32_le(address)- the 32-bit Microsoft Binary Format floating point value (in little-endian form) at the specified address -
double32(address)- the 32 most significant bits of a 64-bit double at the specified address -
double32_be(address)- the 32 most significant bits of a 64-bit double (in big-endian form). Note: specified address should be offset for the most significant bits.
Additionally, you can wrap any of the above functions with these functions to modify the behavior:
-
prev(accessor(address))- the value of the specified address from the previous frame -
prior(accessor(address))- the last differing value of the specified address -
bcd(accessor(address))- converts a BCD-encoded value to decimal for leaderboard and rich presence values.
| Example | Description |
|---|---|
word(0x1234) == 1000 |
Would be true if the two-bytes at $1234 were E8 03 (0x03E8 = 1000) |
byte(0x4567) > prev(byte(0x4567)) |
Would be true if the byte at $4567 is a larger value than it was in the previous frame |
Additionally, you can match memory to strings assuming they're encoded using ASCII (7-bit latin characters) or Unicode (16-bit international alphabets).
ascii_string_equals(address, string, length=0x7FFFFFFF, transform=a=>a)unicode_string_equals(address, string, length=0x7FFFFFFF, transform=a=>a)
These matches length characters starting at address. If length is unspecified, the length of the string is used.
transform allows the caller to wrap the generated logic in prev or prior (i.e. transform = a => prev(a)). The expression passed to the transform function may be multiple bytes (i.e. dword(address)) as the comparison is broken into chunks.
| Example | Returns | Notes |
|---|---|---|
ascii_string_equals(0x1234, "Hi") |
word(0x1234) == 0x6948 | Implicit length of string (2) used |
ascii_string_equals(0x1234, "World", 6) |
dword(0x1234) == 0x6c726f57 && word(0x1238) == 0x0064 | Explicit length includes null terminator |
ascii_string_equals(0x1234, "World", 6, transform= a=>prev(a)) |
prev(dword(0x1234)) == 0x6c726f57 && prev(word(0x1238)) == 0x0064 |
transform wraps each chunk |
ascii_string_equals(0x1234, "World", 3) |
tbyte(0x1234) == 0x726f57 | Explicit length only checks part of the string |
unicode_string_equals(0x1234, "Hi") |
dword(0x1234) == 0x00690048 | Unicode characters are 16-bits each |