Scan

Pattern scan with IDA-style signatures.

Syntax

Susano.Memory.Scan(pattern, [module], [ripOffset]) -> integer | nil

Parameters

pattern (string): Hex bytes with ?? wildcards, e.g. "48 8B 05 ?? ?? ?? ??".

module (string, optional): Module name to scan, e.g. "ntdll.dll". Defaults to the main executable (GTA5.exe).

ripOffset (integer, optional): If provided, resolves a RIP-relative address at found + ripOffset. Formula: found + ripOffset + 4 + *(int32_t*)(found + ripOffset).

Return(s)

integer: Address of the first match, or nil if not found.

Example(s)

local addr     = Susano.Memory.Scan("48 8B 05 ?? ?? ?? ?? 48 8B 48 08")
local resolved = Susano.Memory.Scan("48 8B 05 ?? ?? ?? ??", nil, 3)
local addr2    = Susano.Memory.Scan("55 48 89 E5", "citizen-resources-client.dll")