Scanning

Scanning

The scan interface is where you find memory addresses by searching for specific values. PINCE uses a filter-based approach like CE: you start with a broad search, then narrow it down by performing additional scans as the value changes in the game.

Scan Workflow

Memory scanning works in two phases:

• First Scan: Click First Scan to start fresh. This searches the entire memory space (or your selected scan scope) for values matching your criteria. The first scan will return thousands or millions of results.
• Next Scan: After the first scan, click Next Scan to filter the previous results based on the new value or how it changed. Each next scan narrows down the results until you've isolated the addresses you want.

Clicking the button again after First Scan (it now reads New Scan) will reset your scan session and start anew.

Value Types

The Value Type dropdown determines what kind of data you're searching for:

• Int(any): Searches for any integer size (8, 16, 32 or 64 bit). Useful when you don't know the exact size.
• Int8, Int16, Int32, Int64: Searches for specific integer sizes. Int32 is the most common for modern games.
• Float(any): Searches for any floating point size (32 or 64 bit).
• Float32, Float64: Searches for specific float sizes. Float32 is most common.
• Any(int, float): Searches for both integer and float values at once. Useful when you don't know whether the value is stored as an integer or a float.
• String: Searches for text strings.
• ByteArray: Searches for raw byte patterns (array of bytes).

Scan Types

The Scan Type dropdown determines how PINCE compares values. Available options depend on whether you're doing a first scan or a next scan:

• For First Scans:
  • Exact: Finds values exactly equal to what you entered.
  • Not: Finds values not equal to what you entered.
  • Less Than: Finds values less than what you entered.
  • More Than: Finds values more than what you entered.
  • Between: Finds values between two numbers (use both input fields).
  • Unknown Value: Finds all values (useful for starting a scan when you don't know the exact value).
• For Next Scans:
  • Exact: Finds values that now equal what you entered.
  • Not: Finds values that now differ from what you entered.
  • Increased: Finds values that have gone up since the last scan.
  • Increased by: Finds values that have gone up by a specific amount.
  • Decreased: Finds values that have gone down since the last scan.
  • Decreased by: Finds values that have gone down by a specific amount.
  • Less Than: Finds values less than what you entered.
  • More Than: Finds values more than what you entered.
  • Between: Finds values between two numbers.
  • Changed: Finds values that have changed (any direction).
  • Unchanged: Finds values that haven't changed.

For String and ByteArray types, only Exact is available for next scans. For first scans, Exact and Unknown Value are available.

Scan Scope

The Scan Scope dropdown controls which memory regions PINCE searches:

• Basic: Searches heap, stack and executable memory. Fastest option, works for some games.
• Normal: Searches heap, stack, executable memory and BSS (uninitialized data). Good balance of speed and coverage, works for most games.
• Read+Write: Searches all readable and writable memory regions. Slower but catches more values.
• Full: Searches all readable memory regions including read-only. Slowest but most thorough.

My recommendation is to start with the default Normal. If you can't find what you're looking for, try Read+Write. Full is not really recommended for normal variables unless you're trying to search for AOB (Array of Bytes/ByteArray) values.

Endianness

The Endianness dropdown controls byte order for multi-byte values:

• Host: Uses your system's native byte order (usually little endian on x86/x64).
• Little: Forces little endian byte order (most common for x86/x64 games).
• Big: Forces big endian byte order (used by some console games, emulators or network protocols).

Most of the time you'll use Host. Only change this if you're searching for values from a different architecture.

Alignment

The Alignment dropdown controls memory alignment filtering:

• Auto: Automatically determines alignment based on value type.
• 1, 2, 4, 8, 16: Only searches addresses that are multiples of the selected alignment.

Using alignment can speed up scans significantly. For example, 4-byte integers are usually aligned to 4-byte boundaries, so you can skip addresses that aren't multiples of 4.

Hex Checkbox

The Hex checkbox toggles hexadecimal input mode for integer scans. When checked, you can enter values in hex format (like FF instead of 255). Useful when working with raw memory values or byte patterns. This checkbox is only enabled for integer value types.

Value Input Fields

You have two input fields for entering search values, separated by a <-> label:

• First field: The primary value to search for.
• Second field: Used for "Between" scans to specify the range.

For most scan types you only need the first field. The second field and the <-> label are only visible when you select "Between" as the scan type.

Manage Scan Regions

The Manage Scan Regions button opens a dialog showing all memory regions that will be scanned. You can check regions to exclude them from your scan. This is useful for:

• Speeding up scans by excluding irrelevant regions
• Avoiding false positives from memory-mapped files
• Focusing on specific modules or libraries

The dialog shows each region's ID, Start Address, Size(bytes), Type, Load Address, Perms and File. Check the boxes next to regions you want to exclude, then click OK. There's also an Invert Selection button to quickly flip your selection.

Search Results Table

After a scan, the results appear in a table with three columns:

• Address: The memory address where the value was found.
• Value: The current value at that address.
• Previous: The value from the previous scan (useful for tracking changes).

Double-click any result to add it to the address table. You can also right click for a context menu:

• Copy Address (Ctrl+C): Copies the selected address to clipboard. When multiple rows are selected, this becomes Copy Addresses (plural).
• Browse this memory region (Ctrl+B): Opens the Memory Viewer's hex dump at this address.
• Disassemble this address (Ctrl+D): Opens the Memory Viewer's disassembly at this address.
• Delete selection (Del): Removes the selected results from the table.

Typical Scan Workflow

Here's a common workflow for finding a value like health:

1. Start with First Scan, set Value Type to Int32, Scan Type to Exact (should be the defaults already).
2. Enter the current health value (e.g. 100) and click First Scan
3. You'll get thousands/millions/billions (depending on game size) of results
4. In the game, let your health change (e.g. take damage to go to 95)
5. Enter the new value (95) and click Next Scan
6. Results narrow down significantly
7. Repeat steps 4-5 until you have a manageable number of results (ideally less than 20)
8. Double click promising addresses to add them to the address table
9. Test each one by modifying the value or freezing it

For values you can't see (like hidden stats), use Unknown Value for the first scan, then use Increased/Decreased/Changed/Unchanged for next scans as you observe the game behaviour.