memtool
Scan and manipulate process memory on Windows and Linux. Supports value scanning, filtering, reading, writing, and disassembly for reverse engineering tasks.
Instructions
Process memory tool for reverse engineering and game hacking. CheatEngine-style workflow: search → filter → filter → find exact addresses → write. Supported: Windows (ReadProcessMemory/WriteProcessMemory), Linux (/proc/pid/mem). macOS: not supported (SIP). Operations: regions (list memory map), search (value scan or unknown initial value scan, creates session), filter (narrow: exact/changed/unchanged/increased/decreased), undo (restore previous filter), read (hex dump), write (modify memory), disasm (disassemble live memory — x86/x64/ARM/ARM64), info (session status + values), close (end session), struct_search (multi-field pattern), pointer_scan (find pointer chains to address), diff (compare memory snapshots).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Operation: regions, search, filter, read, write, disasm, info, close, undo, struct_search, pointer_scan, diff,required | |
| pid | No | Target process ID (for regions, search, read, write, disasm, struct_search, pointer_scan, diff) | |
| session_id | No | Session ID from a previous search (for filter, info, close, undo, diff) | |
| value_type | No | Value type: int8/16/32/64, uint8/16/32/64, float32/64, string, utf16, bytes | |
| value | No | Search/write value (number for numeric types, text for string/utf16, hex bytes like '4D 5A 90' for bytes). Omit for unknown initial value scan. | |
| endian | No | Byte order: little (default) or big | |
| filter_type | No | Filter: exact, changed, unchanged, increased, decreased | |
| address | No | Hex address (e.g. '0x7FF6A1B20000') for read/write/disasm/pointer_scan | |
| length | No | Bytes to read/disasm (default 256 for read, 64 for disasm, max 4096) | |
| protection | No | Filter by protection: r, rw, rx | |
| max_results | No | Max results to display (default 100, max 1000) | |
| struct_pattern | No | JSON array for struct search: [{offset:0,type:'int32',value:'100'},{offset:4,type:'int32',value:'50'}] | |
| max_depth | No | Pointer scan max chain depth (default 3, max 5) | |
| max_offset | No | Pointer scan max offset from target (default 0x1000) | |
| arch | No | CPU architecture for disasm: x86 (default) or arm | |
| mode | No | CPU mode for disasm: 32 or 64 (default) | |
| count | No | Number of instructions to disassemble (default 50, max 200) |