Memory

Domain: memory

Memory analysis domain for native scans, pointer-chain discovery, structure inference, and breakpoint-based observation.

Profiles

• full

Typical scenarios

• Run first/next scans to narrow target values
• Analyze pointer chains and in-memory structures
• Manage scan sessions and memory breakpoints

Common combinations

• memory + process
• memory + debugger
• memory + workflow

Full tool list (75)

Tool	Description
memory_first_scan	Start a new memory scan session.
memory_next_scan	Narrow an existing scan session. Supports delta modes: changed_by (value changed by exactly N), increased_by (value increased by at least N), decreased_by (value decreased by at least N), changed_by_variable (returns per-address delta in results).
memory_unknown_scan	Start an unknown initial value scan.
memory_pointer_scan	Find pointers to a target address.
memory_group_scan	Search for multiple values at known offsets simultaneously.
memory_scan_session	Manage scan sessions. Actions: list (all sessions), delete (by sessionId), export (as JSON).
memory_search_string	Search process memory for strings matching a pattern. Wraps memory_first_scan with valueType=string for convenience and adds substring/regex post-filtering. Optionally also searches for UTF-16LE (wide) strings.
memory_pointer_chain	Pointer chain operations: scan (multi-level BFS), autoscan (auto-discover pointer chains by recursively scanning for pointers that point to or near the target address), validate, resolve, or export as JSON. autoscan is Cheat Engine's "pointer scan" equivalent — no manual base/offsets needed.
memory_structure_analyze	Analyze memory at an address to infer data structure layout.
memory_vtable_parse	Parse a vtable to enumerate virtual function pointers and resolve them to module+offset. Also attempts RTTI parsing for class name and inheritance hierarchy.
memory_structure_export_c	Export an inferred structure as a C-style struct definition, ReClass.NET XML, Rust #[repr(C)], or C# [StructLayout] with explicit FieldOffset attributes. C export auto-detects composite types (Vector3, Matrix4x4, pointer arrays).
memory_structure_compare	Compare struct instances to identify differing vs constant fields. Two modes: (1) Pairwise—compare address1 vs address2. (2) Group comparison (CE dissect data parity)—pass arrays of addresses in group1Addresses and group2Addresses. Group mode computes per-offset statistics and classifies fields as: between_groups (differs across groups—likely gameplay state), within_group (varies within groups—dynamic), constant_all (same everywhere—likely vtable, type flags). Returns confidence scores.
memory_breakpoint	Breakpoint via hardware debug registers (DR0-DR3) or software INT3 (0xCC). Actions: set, remove, list, trace. Hardware BPs (type='hardware'): use x64 DR0-DR3, max 4 concurrent, support read/write/readwrite/execute. Software BPs (type='software'): use INT3 (0xCC) patching, unlimited count, execute-only. Two debugger modes: "win32" (default, uses DebugActiveProcess — freezes entire process) and "veh" (Vectored Exception Handler — injects shellcode, only faulting thread pauses). VEH mode is less intrusive but requires code injection which may be detected by anti-cheat systems. Conditional breakpoints: pass a JS expression as "condition" (e.g. "rax > 0x1000"), evaluated against register context on each hit; falsy results auto-resume without reporting.
memory_patch_bytes	Write bytes to target process at address. Saves original bytes for undo. Use for runtime code patching.
memory_patch_nop	NOP out instructions at address (replace with 0x90). Useful for disabling checks or jumps.
memory_patch_undo	Undo a previous patch by restoring the original bytes.
memory_code_caves	Find code caves (runs of 0x00 or 0xCC) in executable sections of loaded modules. Returns largest caves first.
memory_allocate	Allocate executable memory in target process (VirtualAllocEx wrapper). Win32 only. Requires JSHOOK_INJECTION_ENABLE=1.
memory_free	Free remote memory in target process (VirtualFreeEx wrapper). Win32 only. Requires JSHOOK_INJECTION_ENABLE=1.
memory_inject_shellcode	Inject shellcode into target process. Win32 only. Methods: createremote (CreateRemoteThread) or ntcreatethread (NtCreateThreadEx). Requires JSHOOK_INJECTION_ENABLE=1.
memory_inject_dll	Inject a DLL into target process. Win32 only. Modes: loadlibrary (LoadLibraryW injection) or manualmap (manual mapping). Requires JSHOOK_INJECTION_ENABLE=1.
memory_write_value	Write a typed value to a memory address. Supports undo/redo via memory_write_history(action=undo|redo).
memory_batch_edit	Write a value to ALL addresses in a scan session at once. Thin wrapper that iterates through the session address list and calls writeValue for each. Capped at 1000 addresses per call with a clear error when exceeded. Destructive — an audit trail entry is recorded for each write. Equivalent to GameGuardian's gg.editAll() or Cheat Engine's "Edit All".
memory_watch	Poll a memory address until its value changes (like scanmem's "watch" command). Reads the current value, then polls at a configurable interval. Returns immediately with the old value, new value, and elapsed time when a change is detected. If no change occurs within the timeout, returns the unchanged value and a hint. Useful for "tell me when this variable changes" workflows.
memory_freeze	Freeze or unfreeze a memory address. Freeze continuously writes a value to prevent changes; unfreeze stops it.
memory_dump	Dump memory region as hex with ASCII column. Outputs a formatted hex dump similar to xxd.
memory_read_typed	Read process memory as typed numeric values with explicit endianness. Decodes consecutive values starting at address via koffi endian-sensitive integer types (uint64_le / int32_be / …) — no manual byte swapping needed. 64-bit values are returned as decimal strings alongside two's-complement hex. float/double use IEEE-754 with the requested endianness. Supports up to 1024 consecutive values. Ideal for struct inspection, big-endian network payloads, and game memory analysis.
memory_speedhack	Hook time APIs (GetTickCount64/GetTickCount/QueryPerformanceCounter/QueryPerformanceFrequency/timeGetTime/GetSystemTimeAsFileTime) to scale process time via an in-process SSE2 trampoline. time via an in-process SSE2 trampoline. Actions: apply (hook + set speed), set (adjust speed without re-hooking), restore (unhook and restore original functions). Speed range 0.01–100x; values outside this range are rejected to avoid destabilising the target.
memory_write_history	Undo or redo the last memory write operation. Pass pid to scope the operation to a specific process — per-PID undo prevents reverting an unrelated process's write when multiple processes are being edited concurrently.
memory_heap_enumerate	Enumerate all heaps and heap blocks in a process via Toolhelp32 snapshot. Returns heap list with block counts, sizes, and overall statistics.
memory_heap_stats	Get detailed heap statistics with size distribution buckets (0-64B, 64B-1KB, 1-64KB, 64KB-1MB, >1MB), fragmentation ratio, and aggregate metrics.
memory_heap_anomalies	Detect heap anomalies: heap spray patterns (many same-size blocks), possible use-after-free (non-zero free blocks), and suspicious block sizes (0 or >100MB).
memory_pe_headers	Parse PE headers (DOS, NT, File, Optional) from a module base address in process memory. Returns machine type, entry point, image base, section count, and data directory info.
memory_pe_imports_exports	Parse import and/or export tables from a PE module in process memory. Returns DLL names, function names, ordinals, hints, and forwarded exports. Cross-platform: parses ELF .dynsym / Mach-O LC_SYMTAB from disk when moduleName is given on Linux/macOS.
memory_inline_hook_detect	Detect hooks in process modules. scanMode "inline" (default) compares the first 16 bytes of each exported function disk-vs-memory and recognises 8 hook patterns (JMP/CALL/short-jmp/MOV+JMP/MOV+CALL/PUSH+RET/INT3/padding). scanMode "iat" detects Import Address Table hooks (entries redirected outside their source module — evades inline detection, used by EasyHook/MinHook/Detours). scanMode "both" runs both scans.
memory_anticheat_detect	Scan process imports for anti-debug/anti-cheat mechanisms: IsDebuggerPresent, NtQueryInformationProcess, timing checks (QPC, GetTickCount), thread hiding, heap flag checks, and DR register inspection. Each detection includes a bypass suggestion.
memory_guard_pages	Find all memory regions with PAGE_GUARD protection in a process. Guard pages are often used as anti-tampering mechanisms or stack overflow detection.
memory_integrity_check	Check executable memory regions against their corresponding on-disk PE files (.text sections) to detect modifications like inline hooks or code patches.
memory_region_enumerate	Enumerate memory regions in a target process. Cross-platform: Windows (VirtualQueryEx), macOS (mach_vm_region), Linux (/proc/pid/maps). Returns base address, size, protection (r/w/x/rw/rx/rwx), state, type (image/mapped/private), and module name (if module-backed). Emulator mode (mode="emulator"): use with memory_emulator_detect to get emulator-specific memory region descriptors (EE RAM for PCSX2, MEM1/MEM2 for Dolphin, etc.) and filter results.
memory_aob_scan	Array-of-Bytes scan with wildcard and operator support (CE 7.6 parity). Search for byte patterns like "48 8B ?? ?? 00 00" across readable memory. Supports hex bytes (00-FF, optional 0x prefix), "??" wildcards, and operators: >XX (greater than), <XX (less than), XX-YY (range inclusive). Example: "48 8B >40 <80 00 00" matches bytes >0x40 at position 2 and <0x80 at position 3. Case insensitive. Use regionFilter to restrict to specific modules or skip system modules.
memory_find_accesses	Find what writes to or accesses a memory address (Cheat Engine MWT workflow). Sets a hardware breakpoint on the target address, auto-rearms after each hit, captures the faulting instruction address + context + timestamp, and optionally disassembles the instruction. Returns aggregated hits with per-hit instruction details.
memory_cheat_table	Import, export, sign, or verify Cheat Engine .CT files. Export: converts JSON entries to valid .CT XML. Import: parses .CT XML to JSON. Sign: HMAC-SHA256 sign the XML using a secret (from JSHOOK_TABLE_SECRET env var, state_board "memory_ct_sign" secret key, or explicit "secret" arg). Verify: validate a signed table's HMAC signature. Addresses can be hex or module+offset.
memory_generate_signature	Generate an update-resistant AOB (Array-of-Bytes) signature from bytes at a memory address. Detects relative offsets in CALL/JMP/LEA/Jcc instructions and replaces the displacement bytes with wildcards (??), making the signature survive minor code changes between updates. Uses byte-pattern heuristics — no Capstone dependency required.
memory_rtti_info	Parse MSVC RTTI (Run-Time Type Information) at an object address. Reads vtable pointer, follows the Complete Object Locator chain, extracts class name, base classes, and class hierarchy descriptor. Equivalent to CE's "Find out what addresses this code accesses" for type discovery — quickly answer "what type is this object?" without a full structure analysis. Only works on MSVC x64 binaries with RTTI enabled.
memory_parse_dump	Parse a Windows Minidump (.dmp) file and extract forensic information: loaded modules (base/size/name/timestamp), threads (ID/stack/context), memory ranges (64-bit or 32-bit), system info (OS/CPU), and exception records. Optionally resolve a list of addresses against the dump contents. Pure TS — cross-platform (can analyze Windows dumps on Linux/macOS).
memory_mono_detect	Detect Mono or IL2CPP runtime in a target process. Returns runtime kind (mono/il2cpp), module name, pointer size, and root domain address if resolved. Works on Unity games and other Mono/.NET applications.
memory_mono_assemblies	List Mono assemblies loaded in the root domain of a Unity/Mono process. Returns assembly name, address, and image address. Optionally filter by name substring.
memory_mono_classes	List Mono classes in a specific assembly from a Unity/Mono process. Reads the MonoImage type definition table (MONO_TABLE_TYPEDEF) and resolves class names from the string heap. Optionally filter by namespace.
memory_mono_objects	Find live Mono objects of a specific class in the managed heap. Resolves class vtable, then scans writable heap regions for vtable pointer matches. Returns object addresses with class name and estimated size.
memory_mono_fields	Read field values from a Mono object at the given address. Resolves the class via vtable pointer, walks MonoClass fields, and decodes each field value with type-aware heuristics (int, float, string pointer detection).
memory_mono_methods	Inspect method count for a Mono class in a Unity/Mono process. Full method name enumeration requires walking the MonoMethod table from MonoImage (not yet implemented — returns methodCount from the type definition table).
memory_handle_enum	Enumerate all open handles in a target process via NtQuerySystemInformation. Returns handle value, object type, access mask, and object name for each handle. Filterable by type: File, Key, Process, Thread, Token, Section, etc. Useful for finding handles to protected resources and analyzing process security posture. Win32-only, admin required.
memory_protect	Change memory page protection for a region in the target process. Wraps VirtualProtectEx (Win32) / mprotect (Linux) / mach_vm_protect (macOS). Protection: r (read-only), rw (read-write), rx (read-execute), rwx (all), none (no-access). Returns the old protection. Destructive — audit trail recorded.
memory_region_compare	Compare two memory regions byte-by-byte and return a diff summary. Equivalent to Cheat Engine's compareMemory(). Returns identical flag, diff count, and per-offset differences (byte1, byte2). Max compare size: 64KB.
memory_bookmark	Manage address bookmarks for a process. Actions: add (bookmark an address with optional label and color), remove (delete a bookmark), list (show all bookmarks for the PID), clear (remove all bookmarks for the PID). Labels help categorize findings; colors use hex format (e.g. "#FF0000"). Bookmarks are scoped per PID. For long-term persistence, export via state_board_io with namespace "memory_bookmarks:<pid>".
memory_type_define	Override field types in an inferred structure. Actions: set (define a type at offset+size), list (show all overrides), clear (remove all overrides). Overrides are applied in subsequent memory_structure_analyze calls. Supported types: int8, uint8, int16, uint16, int32, uint32, int64, uint64, float, double, pointer, string_ptr, vtable_ptr, hex, padding, unknown.
memory_emulator_detect	Detect if a target process is a known console emulator (ArtMoney parity). Supports: PCSX2, Dolphin, RPCS3, Yuzu, Cemu, ePSXe, PPSSPP, xemu. Detection uses process name matching + optional module fingerprint confirmation. Returns emulator name, platform, and known memory region layout for emulator-mode scanning. Set list=true to enumerate all known emulators without a process check.
memory_register_type	Register a custom value type for memory scanning (Cheat Engine parity). Registered types can be used as valueType in memory_first_scan, memory_unknown_scan, etc. Types are session-scoped (live as long as the domain handler instance).
memory_list_types	List all registered custom scan types.
memory_unregister_type	Remove a registered custom scan type by name.
memory_call_stack	Walk the call stack of a target process thread using the x64 RBP frame-pointer chain. Suspends the thread, reads the CONTEXT to get RBP/RSP/RIP, then follows the linked list of saved_RBP / return_address frames via ReadProcessMemory. Resolves module names using Toolhelp32 module snapshots. Returns an array of {frameIndex, returnAddress, moduleName, functionName}. Equivalent to x64dbg's "standard" call stack mode. Win32 (x64) only — requires Administrator privileges.
memory_process_control	Suspend or resume a target process for consistent memory snapshots. Suspend freezes all threads (NtSuspendProcess on Win32, SIGSTOP on Linux, task_suspend on macOS) so memory reads/scans see a consistent state. Resume thaws all threads. Useful before memory_dump or memory_first_scan for processes with actively-changing memory. Cross-platform.
memory_find_references	Find all references to an address in executable memory (x64dbg parity). Scans all executable regions for CALL rel32, JMP rel32, Jcc rel32, LEA [RIP+disp32], and MOV [RIP+disp32] instructions that reference the target address. Uses pure-TS byte-pattern heuristics — no Capstone dependency. Returns reference type, source address, disassembly, module name, and module offset. Optionally filter by module name.
memory_reverse_mwt	Reverse memory write trace — given a code address, find what data addresses the instruction accesses. Inverse of memory_find_accesses. Disassembles the instruction at the given address using Capstone, then resolves RIP-relative and absolute memory operands to their target addresses. Returns instruction text, raw bytes, and a list of accessed addresses with access type (READ/WRITE/RIP_REL). Useful for understanding what data a specific piece of code operates on.
memory_trace_code	Ultimap-style instruction-level code tracing. Sets INT3 (0xCC) software breakpoints at function entry points and logs every execution. Aggregates hit counts per address to produce a hot-code-path heat map. Win32-only — requires the Win32 debug API (DebugActiveProcess). Provide either "addresses" (list of specific hex addresses) or "startAddress" + "size" (range to scan for 0x55 push-rbp prologues). Max trace time: 30s, max hits: 10000.
memory_pointer_map	Save, load, or compare pointer maps for cross-instance filtering (Cheat Engine .PTR parity). save: serialize pointer scan results to a .ptr.json file in <project>/.ptr/. load: deserialize a pointer map from file. compare: load 2+ pointer map files and find addresses that appear in ALL maps — the CE "rescan across multiple instances" workflow for finding stable pointer chains.
memory_assemble	Assemble x64 assembly instructions to machine code bytes (x64dbg inline assembler parity). Uses Keystone assembler via koffi FFI (keystone.dll) if available on Windows, with a built-in fallback opcode table for common instructions (NOP, RET, INT3, PUSH/POP, MOV, XOR, ADD, SUB, INC, DEC). assemble: compile ASM string to hex bytes. assemble_at: assemble + write directly to target process memory at address (destructive, audit trail recorded). Separate multiple instructions with semicolons or newlines. Max 256 instructions, 4096 assembled bytes.
memory_auto_assemble	Execute a Cheat Engine-style Auto Assembler script. Parses [ENABLE]/[DISABLE] sections and executes ENABLE commands. Supported commands: ALLOC(name,size), DEALLOC(name), LABEL(name[,addr]), REGISTERSYMBOL(name), AOBSCAN(name,pattern), ASSERT(address,bytes), CREATETHREAD(address), DEFINE(name,value), FULLACCESS(address,size), READMEM(address,size), WRITEMEM(address,bytes). INCLUDE and LOADBINARY are rejected for security. Returns a disableScript for use with memory_auto_assemble_disable. Win32 only — requires native process access.
memory_auto_assemble_disable	Execute the DISABLE section of a previously-run Auto Assembler script. Pass the disableScript returned by memory_auto_assemble. Executes DISABLE commands, running DEALLOC last (CE convention). Win32 only — requires native process access.
memory_remote	Connect to a remote jshookmcp MCP server via WebSocket for remote debugging. Enables ceserver-style remote memory operations: connect to a remote instance, forward tool calls (memory read/write, process enumerate, etc.), and receive results. Uses JSON-RPC 2.0 over WebSocket with auth token support and auto-reconnect. Actions: connect (establish WebSocket link), disconnect (tear down), status (connection state + stats), forward (proxy a tool call to the remote instance).
memory_hypervisor	EPT Hypervisor Phase 1: VMXON, VMCS setup, basic VM-exit handler design, CPUID spoofing. Intel VT-x only. Requires BYOVD kernel driver for MSR reads and VMXON region preparation. Gate: JSHOOK_HYPERVISOR_ENABLE=1 + admin. Actions: capabilities (detect VT-x/EPT/VPID, MSR values, Hyper-V conflicts), load (validate readiness + build VMCS config), unload (reset state), status (runtime state). NOTE: Actual VMXON/VMLAUNCH execution requires a kernel-mode component (not yet implemented). Phase 1 provides detection, configuration, and the exit-handler design.
memory_antidetection	Anti-detection hardening toolkit. Actions: check (run all detectors — kernel callbacks, instrumentation callback, AMSI/ETW status, chaos mode, platform info), harden (apply AMSI/ETW patches + process masquerade + self-defense — destructive), status (read-only current protection state). WARNING: harden action modifies process memory and mitigation policies. ProcessBreakOnTermination is PERMANENTLY DISABLED (stub — no BSOD risk). On non-Windows, returns platform info only.
memory_antidetection_check	Pre-flight anti-detection security audit. READ-ONLY — no patches or modifications. Checks: (1) ETW/AMSI patch status, (2) debugger attached to self via IsDebuggerPresent, (3) HVCI (Hypervisor-protected Code Integrity) and VBS (Virtualization-Based Security) status via registry, (4) known anti-cheat/EDR/AV/debugger processes via process enumeration. Returns a pass/warn/fail verdict with a 0-100 score, per-check results, and actionable recommendations. All checks are safe, user-mode, read-only operations. For actual hardening, use memory_antidetection action=harden.
memory_session_export	Export a scan session's complete state as structured JSON. Returns sessionId, pid, valueType, addresses[], values{}, and metadata. Pure data export — no workflow, no replay. Addresses are capped at 100K with a truncated flag when the cap is hit.
memory_freeze_export	Export all active freeze entries as structured JSON. Returns an array of freeze entries with freezeId, pid, address, value, valueType, intervalMs, and active flag. Optional pid filter to scope the export to a single process. Pure data export — no workflow, no replay.