⚡ WinAobscanFast

Blazing fast memory scanning (AOB) powered by SIMD & Parallelism.
Written in modern C# for those who care about performance.

🚀 Why this project?

Need to find a byte pattern in another process, but standard solutions are too slow or outdated? WinAobscanFast leverages modern hardware to get the job done instantly.

• 💎 Hardware Intrinsics: Built with Vector512, Vector256, and Vector128. If your CPU supports AVX-512, this scanner flies.
• 🧵 Parallel Processing: Memory is chunked and scanned concurrently across all available CPU threads.
• 🧠 Smart Memory Mapping: Automatically maps regions via VirtualQueryEx, skips PAGE_GUARD/NOACCESS, and merges adjacent regions to minimize syscalls.
• 🩸 Modern C#: Uses Span<T>, LibraryImport, ArrayPool, and zero-allocation techniques where possible.

---

📦 Installation

Just clone the repository and drop the project into your solution.

git clone https://github.com/larkliy/WinAobscanFast.git

🔥 Usage

Designed to be simple. No complex configuration, just raw speed.

1. Simple Pattern Scan

using WinAobscanFast.Core;
using WinAobscanFast.Core.Implementations;

// 1. Find the process and get a handle
var pid = WindowsProcessUtils.FindByName("game_process"); // .exe extension is optional
using var handle = WindowsProcessUtils.OpenProcess(pid);

// 2. Initialize the scanner
var scanner = new AobScan(new WindowsMemoryReader(handle));

// 3. Scan! (Supports '??' as wildcards)
// Example: searching for a pointer or instruction set
var results = scanner.Scan("48 8B 05 ?? ?? ?? ?? 48 83 C4 28");

Console.WriteLine($"Found {results.Count} occurrences.");
foreach (var addr in results)
{
    Console.WriteLine($"Address: 0x{addr:X}");
}

2. Advanced Options

Need to scan only Executable memory (e.g., finding functions) or limit the address range?

var options = new AobScanOptions
{
    // Filter regions: Only scan Executable + Readable memory
    MemoryAccess = MemoryAccess.Executable | MemoryAccess.Readable,
    
    // Optional: Restrict scan range
    MinScanAddress = 0x7FF00000000,
    MaxScanAddress = 0x7FFFFFFFFFF
};

var results = scanner.Scan("E8 ?? ?? ?? ?? 90", options);

---

🛠 Under the Hood

How do we achieve this performance?

1. Memory Mapping: We don't read the entire RAM blindly. We query the memory map (VirtualQueryEx) to identify valid committed pages.
2. Chunking: Valid regions are sliced into optimized chunks (default 256KB) for parallel processing.
3. SIMD: The IsMatch method uses specific hardware instructions:

   // Simplified logic
   if (Vector512.IsHardwareAccelerated) {
       // Compare 64 bytes in a single CPU cycle!
   }

---

📊 Performance

On a modern CPU (e.g., i3-10100F), scanning 5.6GB of process memory typically takes 700-800 milliseconds, depending on pattern complexity and hit count.

---

🤝 Contributing

Found a way to make it even faster? Found a bug? Pull Requests and Issues are welcome!

1. Fork it!
2. Create your feature branch: git checkout -b my-new-feature
3. Commit your changes: git commit -am 'Add some feature'
4. Push to the branch: git push origin my-new-feature
5. Submit a pull request

⭐ Support

If you found this project useful or interesting, please give it a Star! 🌟 It helps others find the project and motivates me to improve it.

---

Made with ❤️ and C#