I think TSearch program is the only one has powerful functions after Gamehack 2.0. It can search in-memory-values on both 32bit and 64bit OS.
Step 1. Find Program and Install it
The developer or studio of TSearch has no homepage. But many people has it in their PC. Search at Google or your favorite search engine. You must be careful, there are so many fake or infected programs on the net.
This is TSearch Program.
Step 2. Select your process.
Click "Open Process" on the tool bar. And select the process name. Now we can access its local memory area.
This is selecting process.
I erased some process names related to my privacy.
Step 3. Find a value.
Now let's find somethins. Click maginifying glass icon below toolbar. Most cases you know the exact value. Then choose exact value. But if you don't know the exact value, choose "Unknown" or "Range". We can check the differences after modifying it in the game or program.
"4 bytes" is enough for me long ago.
I found so many results. I typed "0".
Step 4. Change its value and Research
The mechanism of tracking the memory location is "difference check". Now we must make its value to be changed.
For example, in game, your character has one-bucks in his pocket. But you don't satisfy such a poverty. Then you search a value "10" at TSearch. And sell something to increase money amout to 11$. Now you search "11" on previous search result.
Never be confused with left icon.
We can search again, on previos result.
Step 5. Reduce the count of result as less as possible.
Repeat change and research. Because some values are so common on the memory.
After repeating any times, you can find only 1~3 result. Its count will not be changed.
This is the real location of your value. Doubleclick the result line, and modify it at right table. And check the modified value has been applied exactly in your program. If it is not, select another location at left table and modify again.
Trick1. Encrypted value
Some programs store its value with encryption. If you are lucky, you can find its location. Because TSearch provide the difference check feature.
For example, value "10" is stored as "1A0A" after encryption. And you change its value to "11". If the algorithm of encryption is simple, the encrypted value would be "original" + 1.
Trick2. Long Range value.
Sometimes you want to find the series of values. Then use the Hexeditor. You can find it on the tool bar. For example, one record of DB table can be mapped to a chunk of memory. So the value of field may be stored linearly. This situation, Hex editor is more useful.
