2026v0.1.0

memschema

C++20 · CMake · Win32 · Python · Catch2

Overview

Native memory-layout resolution, rebuilt as a library you can actually test.

Tools that inspect native software share one problem: the target's memory layout changes every release, and the code that tracks it usually only runs against a live, moving process, untestable by construction. memschema inverts that: a pluggable IAddressSpace interface with a portable PE dump-file reader and a live-process reader, so pattern scanning, MSVC RTTI lookup, Source2 schema walking and the five-layer offset-resolution ladder all run and get tested offline in CI.

Where did it come from?

Extracted and generalized from the data-driven memory layer of a private R&D platform, where the resolution logic had been refined across many target builds but was welded to a kernel-driver read path. The extraction made every assumption explicit, and the new tests immediately caught two real bugs that had shipped silently in the original.

Field notes

  • Five-layer resolution ladder: warm cache → embedded fallbacks → refreshed needles → published RVA → recorded failure.
  • Caches invalidate by content, re-reading the bytes at each match site, not just by version number.
  • A codegen tool turns JSON dumps into C++ fallback headers; CI is green on Windows and Linux.

Source

github.com/notdezzi/memschema