cheatengine 5.8.26 → 5.8.28

package/README.md

@@ -25,13 +25,13 @@ AI <--MCP/JSON-RPC--> ce_mcp_server.js <--Named Pipe--> ce_mcp_bridge.lua (CE)
      dofile([[D:\path\to\ce_mcp_bridge.lua]])
      ```
 
-3. **Configure MCP** (`.kiro/settings/mcp.json`):
+3. **Configure MCP** :
    ```json
    {
      "mcpServers": {
        "cheat-engine": {
          "command": "npx",
-         "args": ["--yes", "cheatengine"]
+         "args": ["-y", "cheatengine@latest"]
        }
      }
    }
@@ -157,17 +157,19 @@ Write a value to memory.
 
 ### Scanning & Search
 
-#### `ce_aob_scan(aob_string, module?, protection?, max_results?)`
+#### `ce_aob_scan(aob_string, module?, protection?, start?, stop?, max_results?)`
 Scan memory for Array of Bytes pattern. Supports `??` wildcards.
 
 **Parameters:**
 - `aob_string` (string, required): Pattern like `"48 89 5C 24 ?? 48 83 EC 20"`
 - `module` (string, optional): Limit scan to module (e.g. `"game.exe"`)
 - `protection` (string, optional): Memory protection flags (default: `"-C+X"`)
+- `start` (string, optional): Start address if module not specified
+- `stop` (string, optional): Stop address if module not specified
 - `max_results` (integer, optional): Maximum results (default: 100)
 
 #### `ce_value_scan(value, type, module?, protection?)`
-Scan for a specific value. Useful for pointer tracing. **One-shot scan - for iterative scanning use Scan Sessions.**
+Scan for a specific value. Useful for pointer tracing. Auto-aligns scan based on type for performance. **One-shot scan - for iterative scanning use Scan Sessions.**
 
 **Parameters:**
 - `value` (string, required): Value to search (e.g. `"0x255D5E758"` or `"12345"`)
@@ -182,7 +184,7 @@ Scan for a specific value. Useful for pointer tracing. **One-shot scan - for ite
 Implements CE's core "First Scan → Next Scan" workflow with session management. Sessions auto-expire after 5 minutes of inactivity.
 
 #### `ce_scan_new(value, type, module?, protection?)`
-Start a new scan session.
+Start a new scan session. Auto-aligns scan based on type for performance (4-byte for dword/float, 8-byte for qword/double).
 
 #### `ce_scan_next(session_id, value, scan_type?, value2?)`
 Continue scanning (filter) an existing session.

package/README_CN.md

@@ -7,7 +7,7 @@ MCP 桥接器，让 AI 助手直接控制 Cheat Engine 进行游戏修改和逆
 ## 架构
 
 ```
-AI <--MCP/JSON-RPC--> ce_mcp_server.py <--命名管道--> ce_mcp_bridge.lua (CE)
+AI <--MCP/JSON-RPC--> ce_mcp_server.js <--命名管道--> ce_mcp_bridge.lua (CE)
                            ↑
                   后台自动重连
 ```
@@ -16,7 +16,7 @@ AI <--MCP/JSON-RPC--> ce_mcp_server.py <--命名管道--> ce_mcp_bridge.lua (CE)
 
 ### 快速开始 (NPX) - 推荐
 
-1. **安装依赖**: `pip install pywin32`
+1. **前提条件**: Node.js 14+ (无需其他依赖项)
 
 2. **在 CE 中加载** (二选一):
    - **自动加载**: 将 `ce_mcp_bridge.lua` 复制到 CE 的 `autorun` 文件夹 (如 `D:\Cheat Engine\autorun\`)
@@ -25,13 +25,13 @@ AI <--MCP/JSON-RPC--> ce_mcp_server.py <--命名管道--> ce_mcp_bridge.lua (CE)
      dofile([[D:\path\to\ce_mcp_bridge.lua]])
      ```
 
-3. **配置 MCP** (`.kiro/settings/mcp.json`):
+3. **配置 MCP** :
    ```json
    {
      "mcpServers": {
        "cheat-engine": {
          "command": "npx",
-         "args": ["--yes", "cheatengine"]
+         "args": ["-y", "cheatengine@latest"]
        }
      }
    }
@@ -45,8 +45,8 @@ AI <--MCP/JSON-RPC--> ce_mcp_server.py <--命名管道--> ce_mcp_bridge.lua (CE)
 {
   "mcpServers": {
     "cheat-engine": {
-      "command": "python",
-      "args": ["D:/path/to/ce_mcp/ce_mcp_server.py"]
+      "command": "node",
+      "args": ["D:/path/to/ce_mcp/ce_mcp_server.js"]
     }
   }
 }
@@ -157,17 +157,19 @@ Hook 名称现在会验证以防止 AA 脚本注入:
 
 ### 扫描与搜索
 
-#### `ce_aob_scan(aob_string, module?, protection?, max_results?)`
+#### `ce_aob_scan(aob_string, module?, protection?, start?, stop?, max_results?)`
 扫描内存中的字节数组模式。支持 `??` 通配符。
 
 **参数:**
 - `aob_string` (string, 必需): 模式如 `"48 89 5C 24 ?? 48 83 EC 20"`
 - `module` (string, 可选): 限制扫描到模块 (如 `"game.exe"`)
 - `protection` (string, 可选): 内存保护标志 (默认: `"-C+X"`)
+- `start` (string, 可选): 起始地址（未指定 module 时使用）
+- `stop` (string, 可选): 结束地址（未指定 module 时使用）
 - `max_results` (integer, 可选): 最大结果数 (默认: 100)
 
 #### `ce_value_scan(value, type, module?, protection?)`
-扫描特定值。用于指针追踪。**一次性扫描 - 迭代扫描请使用扫描会话。**
+扫描特定值。用于指针追踪。根据类型自动对齐扫描以优化性能。**一次性扫描 - 迭代扫描请使用扫描会话。**
 
 **参数:**
 - `value` (string, 必需): 要搜索的值 (如 `"0x255D5E758"` 或 `"12345"`)
@@ -182,7 +184,7 @@ Hook 名称现在会验证以防止 AA 脚本注入:
 实现 CE 核心的 "首次扫描 → 再次扫描" 工作流，带会话管理。会话在 5 分钟不活动后自动过期。
 
 #### `ce_scan_new(value, type, module?, protection?)`
-开始新的扫描会话。
+开始新的扫描会话。根据类型自动对齐扫描以优化性能（dword/float 用 4 字节对齐，qword/double 用 8 字节对齐）。
 
 #### `ce_scan_next(session_id, value, scan_type?, value2?)`
 继续扫描（过滤）现有会话。
@@ -383,47 +385,47 @@ Hook 函数以拦截调用并捕获参数。
 
 ## 推荐工作流
 
-### 指针追踪
-```json
-// 自动 (首选)
-{"name": "ce_find_pointer_path", "arguments": {"address": "0x255D5E758", "user_prompted": true}}
-// 返回: base_address, offsets, ce_pointer_notation
-
-// 手动 (自动失败时)
-// 1. 查找访问该地址的代码
-{"name": "ce_find_what_accesses", "arguments": {"address": "0x255D5E758", "user_prompted": true}}
-// 2. 从结果获取寄存器值 (如 RBX=0x255D5E658)
-// 3. 搜索存储该值的指针
-{"name": "ce_value_scan", "arguments": {"value": "0x255D5E658", "type": "qword"}}
-// 4. 重复直到找到 game.exe+offset
-```
-
-### 函数分析
-```json
-// 1. 查找函数边界
-{"name": "ce_find_function_boundaries", "arguments": {"address": "0x14587EDB0"}}
-
-// 2. 跟踪执行
-{"name": "ce_break_and_trace", "arguments": {"address": "0x14587EDB0", "max_steps": 100}}
-
-// 3. 生成特征码用于更新
-{"name": "ce_generate_signature", "arguments": {"address": "0x14587EDB0"}}
-```
-
-### 逆向未知代码
-```json
-// 1. 反汇编
-{"name": "ce_disassemble", "arguments": {"address": "0x14587EDB0", "count": 20}}
-
-// 2. 符号跟踪理解逻辑
-{"name": "ce_symbolic_trace", "arguments": {"address": "0x14587EDB0", "initial_state": {"rcx": "this"}}}
-
-// 3. 为复杂函数构建 CFG
-{"name": "ce_build_cfg", "arguments": {"address": "0x14587EDB0"}}
-
-// 4. 检测模式
-{"name": "ce_detect_patterns", "arguments": {"address": "0x14587EDB0"}}
-```
+### 指针追踪
+```json
+// 自动 (首选)
+{"name": "ce_find_pointer_path", "arguments": {"address": "0x255D5E758", "user_prompted": true}}
+// 返回: base_address, offsets, ce_pointer_notation
+
+// 手动 (自动失败时)
+// 1. 查找访问该地址的代码
+{"name": "ce_find_what_accesses", "arguments": {"address": "0x255D5E758", "user_prompted": true}}
+// 2. 从结果获取寄存器值 (如 RBX=0x255D5E658)
+// 3. 搜索存储该值的指针
+{"name": "ce_value_scan", "arguments": {"value": "0x255D5E658", "type": "qword"}}
+// 4. 重复直到找到 game.exe+offset
+```
+
+### 函数分析
+```json
+// 1. 查找函数边界
+{"name": "ce_find_function_boundaries", "arguments": {"address": "0x14587EDB0"}}
+
+// 2. 跟踪执行
+{"name": "ce_break_and_trace", "arguments": {"address": "0x14587EDB0", "max_steps": 100}}
+
+// 3. 生成特征码用于更新
+{"name": "ce_generate_signature", "arguments": {"address": "0x14587EDB0"}}
+```
+
+### 逆向未知代码
+```json
+// 1. 反汇编
+{"name": "ce_disassemble", "arguments": {"address": "0x14587EDB0", "count": 20}}
+
+// 2. 符号跟踪理解逻辑
+{"name": "ce_symbolic_trace", "arguments": {"address": "0x14587EDB0", "initial_state": {"rcx": "this"}}}
+
+// 3. 为复杂函数构建 CFG
+{"name": "ce_build_cfg", "arguments": {"address": "0x14587EDB0"}}
+
+// 4. 检测模式
+{"name": "ce_detect_patterns", "arguments": {"address": "0x14587EDB0"}}
+```
 
 ---
 

package/ce_mcp_bridge.lua

@@ -26,14 +26,14 @@ local pairs = pairs
 local ipairs = ipairs
 local os_clock = os.clock
 
--- ============ Config ============
-local Config = {
-    -- Pipe name: supports environment variable override for anti-detection
-    -- Set CE_MCP_PIPE_NAME environment variable to customize
-    PIPE_NAME = os.getenv("CE_MCP_PIPE_NAME") or "ce_mcp_bridge",
-    -- Authentication token: optional security layer for pipe communication
-    -- Set CE_MCP_AUTH_TOKEN environment variable to enable authentication
-    AUTH_TOKEN = os.getenv("CE_MCP_AUTH_TOKEN") or nil,
+-- ============ Config ============
+local Config = {
+    -- Pipe name: supports environment variable override for anti-detection
+    -- Set CE_MCP_PIPE_NAME environment variable to customize
+    PIPE_NAME = os.getenv("CE_MCP_PIPE_NAME") or "ce_mcp_bridge",
+    -- Authentication token: optional security layer for pipe communication
+    -- Set CE_MCP_AUTH_TOKEN environment variable to enable authentication
+    AUTH_TOKEN = os.getenv("CE_MCP_AUTH_TOKEN") or nil,
     DEBUG_MODE = false,
     MAX_MESSAGE_SIZE = 10 * 1024 * 1024,
     PIPE_BUFFER_SIZE = 1024 * 1024,
@@ -1458,16 +1458,16 @@ local function getDebuggerStatus()
     return status
 end
 
-Handlers.ping = function()
-    return {
-        status = "ok",
-        timestamp = os.time(),
-        process = process or "N/A",
-        pid = getOpenedProcessID() or 0,
-        connections = Context.connectionCount,
-        debugger = getDebuggerStatus()
-    }
-end
+Handlers.ping = function()
+    return {
+        status = "ok",
+        timestamp = os.time(),
+        process = process or "N/A",
+        pid = getOpenedProcessID() or 0,
+        connections = Context.connectionCount,
+        debugger = getDebuggerStatus()
+    }
+end
 
 Handlers.get_process_info = function()
     -- Refresh symbol table using ModuleManager
@@ -1556,16 +1556,16 @@ Handlers.stats = function(p)
         })
     end
 
-    return {
-        uptime = metrics.uptime,
-        commands = metrics.commands,
-        summary = metrics.summary,
-        cache = metrics.cache,
-        logging = logStats,
-        scanSessions = {
-            active = scanSessionCount,
-            maxAllowed = Config.MAX_SCAN_SESSIONS,
-            sessions = scanSessions
+    return {
+        uptime = metrics.uptime,
+        commands = metrics.commands,
+        summary = metrics.summary,
+        cache = metrics.cache,
+        logging = logStats,
+        scanSessions = {
+            active = scanSessionCount,
+            maxAllowed = Config.MAX_SCAN_SESSIONS,
+            sessions = scanSessions
         },
         connections = Context.connectionCount,
         debugger = getDebuggerStatus()
@@ -1707,25 +1707,41 @@ Handlers.aob_scan = function(p)
     end
 
     -- Execute scan
-    local scanResult = nil
-    local success = pcall(function()
-        if startAddr and stopAddr then
-            scanResult = AOBScan(cleanAob, protection, startAddr, stopAddr)
-        else
-            scanResult = AOBScan(cleanAob, protection)
-        end
+    -- Use createMemScan to properly support start/stop range (AOBScan function doesn't support range args correctly)
+    local memscan = createMemScan()
+    local foundList = createFoundList(memscan)
+    local scanOk = false
+    
+    local vtByteArray = vtByteArray or 7
+    local rtRounded = rtRounded or 0
+    local fsmNotAligned = fsmNotAligned or 0
+    local soExactValue = soExactValue or 1
+
+    pcall(function()
+        memscan.firstScan(
+            soExactValue, vtByteArray, rtRounded, 
+            cleanAob, "", 
+            startAddr or 0, stopAddr or 0x7FFFFFFFFFFFFFFF, 
+            protection, fsmNotAligned, "", 
+            true, false, false, false
+        )
+        memscan.waitTillDone()
+        scanOk = true
     end)
 
-    if not success or not scanResult then
-        return { count = 0, results = {}, message = "No results found" }
+    if not scanOk then
+        pcall(function() memscan.destroy() end)
+        return { count = 0, results = {}, error = "AOB Scan failed" }
     end
 
+    foundList.initialize()
+    local totalCount = foundList.Count or 0
+    
     local results = {}
-    local totalCount = scanResult.Count or 0
     local count = math_min(totalCount, maxResults)
 
     for i = 0, count - 1 do
-        local addr = scanResult[i]
+        local addr = foundList.Address[i]
         if addr then
             if type(addr) == "string" then
                 table_insert(results, addr)
@@ -1735,7 +1751,8 @@ Handlers.aob_scan = function(p)
         end
     end
 
-    scanResult.destroy()
+    foundList.deinitialize()
+    memscan.destroy()
 
     return {
         count = totalCount,
@@ -1807,8 +1824,14 @@ Handlers.value_scan = function(p)
 
     -- Execute scan
     local scanOk = pcall(function()
+        -- Determine alignment
+        local alignType = fsmAligned
+        local alignParam = "4"
+        if vt == vtQword or vt == vtDouble then alignParam = "8" end
+        if vt == vtByte then alignType = fsmNotAligned end
+        
         memscan.firstScan(soExactValue, vt, rtRounded, scanValue, "",
-            startAddr, stopAddr, protection, fsmNotAligned, "",
+            startAddr, stopAddr, protection, alignType, alignParam,
             isHex, false, false, false)
         memscan.waitTillDone()
     end)
@@ -1951,8 +1974,14 @@ Handlers.scan_new = function(p)
 
     -- Execute first scan
     local scanOk = pcall(function()
+        -- Determine alignment
+        local alignType = fsmAligned
+        local alignParam = "4"
+        if vt == vtQword or vt == vtDouble then alignParam = "8" end
+        if vt == vtByte then alignType = fsmNotAligned end
+        
         memscan.firstScan(soExactValue, vt, rtRounded, scanValue, "",
-            startAddr, stopAddr, protection, fsmNotAligned, "",
+            startAddr, stopAddr, protection, alignType, alignParam,
             isHex, false, false, false)
         memscan.waitTillDone()
     end)
@@ -4762,55 +4791,75 @@ Handlers.find_call_references = function(p)
         for _, pattern in ipairs(patterns) do
             if #callers >= limit then break end
 
-            local scanResult = AOBScan(pattern, "+X", segStart, segEnd)
-            if scanResult and scanResult.Count > 0 then
-                totalMatches = totalMatches + scanResult.Count
-
-                for i = 0, scanResult.Count - 1 do
-                    if #callers >= limit then break end
-
-                    local callAddrStr = scanResult[i]
-                    local callAddr = tonumber(callAddrStr, 16)
+            -- Use MemScan for range-limited AOB scan
+            local ms = createMemScan()
+            local fl = createFoundList(ms)
+            local scanOk = false
+            
+            pcall(function()
+                -- 0=soExactValue, 7=vtByteArray, 0=rtRounded
+                -- fsmNotAligned=0, ""=alignParam
+                -- true=hex, false=notBinary, false=unicode, false=caseSensitive
+                ms.firstScan(0, 7, 0, pattern, "", segStart, segEnd, "+X", 
+                            0, "", true, false, false, false)
+                ms.waitTillDone()
+                scanOk = true
+            end)
 
-                    if callAddr then
-                        -- Verify: read actual rel32 and check target
-                        local relOffset = readInteger(callAddr + 1)
-                        if relOffset then
-                            if relOffset > 0x7FFFFFFF then
-                                relOffset = relOffset - 0x100000000
-                            end
-                            local target = callAddr + 5 + relOffset
-
-                            if target == funcAddr then
-                                local disasm = ""
-                                local symbol = nil
-                                pcall(function()
-                                    disasm = disassemble(callAddr) or "???"
-                                    symbol = getNameFromAddress(callAddr, true)
-                                end)
-
-                                -- Avoid duplicates
-                                local isDup = false
-                                for _, c in ipairs(callers) do
-                                    if c.address == Utils.formatHex(callAddr) then
-                                        isDup = true
-                                        break
-                                    end
+            if scanOk then
+                fl.initialize()
+                local count = fl.Count or 0
+                if count > 0 then
+                    totalMatches = totalMatches + count
+
+                    for i = 0, count - 1 do
+                        if #callers >= limit then break end
+
+                        local callAddrStr = fl.Address[i]
+                        -- Address can be string or number depending on CE version
+                        local callAddr = type(callAddrStr) == "string" and tonumber(callAddrStr, 16) or callAddrStr
+
+                        if callAddr then
+                            -- Verify: read actual rel32 and check target
+                            local relOffset = readInteger(callAddr + 1)
+                            if relOffset then
+                                if relOffset > 0x7FFFFFFF then
+                                    relOffset = relOffset - 0x100000000
                                 end
+                                local target = callAddr + 5 + relOffset
+
+                                if target == funcAddr then
+                                    local disasm = ""
+                                    local symbol = nil
+                                    pcall(function()
+                                        disasm = disassemble(callAddr) or "???"
+                                        symbol = getNameFromAddress(callAddr, true)
+                                    end)
+
+                                    -- Avoid duplicates
+                                    local isDup = false
+                                    for _, c in ipairs(callers) do
+                                        if c.address == Utils.formatHex(callAddr) then
+                                            isDup = true
+                                            break
+                                        end
+                                    end
 
-                                if not isDup then
-                                    table_insert(callers, {
-                                        address = Utils.formatHex(callAddr),
-                                        instruction = disasm,
-                                        symbol = symbol
-                                    })
+                                    if not isDup then
+                                        table_insert(callers, {
+                                            address = Utils.formatHex(callAddr),
+                                            instruction = disasm,
+                                            symbol = symbol
+                                        })
+                                    end
                                 end
                             end
                         end
                     end
                 end
-                scanResult.destroy()
+                fl.deinitialize()
             end
+            ms.destroy()
         end
     end
 
@@ -7485,162 +7534,162 @@ function Pipe.executeRequest(req)
     end
 end
 
--- Helper function to send error response without breaking connection
-local function sendErrorResponse(errorMsg)
-    local resp = { error = errorMsg }
-    local respStr = JSON.encode(resp)
-    local respLen = #respStr
-    
-    pcall(function()
-        Context.pipeServer.lock()
-        pcall(function()
-            Context.pipeServer.writeDword(respLen)
-            Context.pipeServer.writeString(respStr, false)
-        end)
-        Context.pipeServer.unlock()
-    end)
-end
-
-function Pipe.workerLoop()
-    Utils.debugPrint("Worker started")
-    local consecutiveErrors = 0
-
-    while Context.serverRunning do
-        local acceptOk, acceptErr = pcall(function()
-            Context.pipeServer.acceptConnection()
-        end)
-
-        if not acceptOk then
-            consecutiveErrors = consecutiveErrors + 1
-            if consecutiveErrors > Config.MAX_CONSECUTIVE_ERRORS then
-                Utils.debugPrint("Too many consecutive errors, restarting pipe...")
-                pcall(function() Context.pipeServer.destroy() end)
-                Context.pipeServer = createPipe(Config.PIPE_NAME, Config.PIPE_BUFFER_SIZE, Config.PIPE_BUFFER_SIZE)
-                consecutiveErrors = 0
-            end
-            if Context.serverRunning then
-                sleep(Config.HEARTBEAT_INTERVAL)
-            end
-        else
-            consecutiveErrors = 0
-            Context.connectionCount = Context.connectionCount + 1
-            Context.lastActivityTime = os_clock()  -- Heartbeat: record connection time
-            Utils.debugPrint("Client connected (#" .. Context.connectionCount .. ")")
-            
-            local sessionErrors = 0
-
-            while Context.serverRunning and Context.pipeServer and Context.pipeServer.Valid do
-                Utils.periodicCleanup()
-
-                -- Read size
-                local ok, size = false, nil
-                pcall(function()
-                    Context.pipeServer.lock()
-                    ok, size = pcall(Context.pipeServer.readDword)
-                    Context.pipeServer.unlock()
-                end)
-
-                if not ok or not size or size == 0 then
-                    sessionErrors = sessionErrors + 1
-                    if sessionErrors >= Config.MAX_SESSION_ERRORS then
-                        Utils.debugPrint("Too many session errors, disconnecting client")
-                        -- Send error before disconnecting
-                        sendErrorResponse("Too many consecutive read errors")
-                        break
-                    end
-                    sleep(10)
-                    goto continue
-                end
-
-                if size >= Config.MAX_MESSAGE_SIZE then
-                    Utils.debugPrint("Message too large: " .. size)
-                    sendErrorResponse("Message too large: " .. size .. " bytes (max: " .. Config.MAX_MESSAGE_SIZE .. ")")
-                    break
-                end
-
-                sessionErrors = 0
-
-                -- Read payload
-                local ok2, payload = false, nil
-                pcall(function()
-                    Context.pipeServer.lock()
-                    ok2, payload = pcall(Context.pipeServer.readString, size)
-                    Context.pipeServer.unlock()
-                end)
-
-                if ok2 and payload and #payload == size then
-                    local decodeOk, req = pcall(JSON.decode, payload)
-                    if not decodeOk or not req then
-                        Utils.debugPrint("Failed to decode JSON payload")
-                        sendErrorResponse("Invalid JSON payload")
-                        goto continue
-                    end
-                    
-                    local resp = nil
-
-                    -- Use optimized request execution (sync on demand)
-                    resp = Pipe.executeRequest(req)
-
-                    local respStr = JSON.encode(resp)
-                    local respLen = #respStr
-
-                    if respLen > Config.MAX_MESSAGE_SIZE then
-                        respStr = JSON.encode({ error = "Response too large" })
-                        respLen = #respStr
-                    end
-
-                    local writeOk = false
-                    pcall(function()
-                        Context.pipeServer.lock()
-                        writeOk = pcall(function()
-                            Context.pipeServer.writeDword(respLen)
-                            Context.pipeServer.writeString(respStr, false)
-                        end)
-                        Context.pipeServer.unlock()
-                    end)
-
-                    if writeOk then
-                        Context.lastActivityTime = os_clock()  -- Heartbeat: update on successful communication
-                    else
-                        Utils.debugPrint("Failed to write response")
-                        break
-                    end
-                else
-                    Utils.debugPrint("Failed to read payload: expected " .. size .. " bytes")
-                    sendErrorResponse("Failed to read payload: expected " .. size .. " bytes, got " .. tostring(#(payload or "")))
-                    -- Don't break, allow client to retry
-                    sleep(50)
-                end
-
-                ::continue::
-            end
-
-            pcall(function()
-                if Context.pipeServer and Context.pipeServer.Valid then
-                    Context.pipeServer.disconnect()
-                end
-            end)
-            Context.lastActivityTime = 0  -- Heartbeat: reset on disconnect
-            Utils.debugPrint("Client disconnected, recreating pipe for next connection...")
-            
-            -- Recreate pipe instance for next client (Windows named pipes are single-client)
-            pcall(function()
-                if Context.pipeServer then
-                    Context.pipeServer.destroy()
-                end
-            end)
-            Context.pipeServer = createPipe(Config.PIPE_NAME, Config.PIPE_BUFFER_SIZE, Config.PIPE_BUFFER_SIZE)
-            
-            if not Context.pipeServer or not Context.pipeServer.Valid then
-                Utils.debugPrint("Failed to recreate pipe, restarting worker loop...")
-                sleep(100)
-            else
-                Utils.debugPrint("Pipe recreated, ready for next connection")
-            end
-        end
-    end
-    Utils.debugPrint("Worker stopped")
-end
+-- Helper function to send error response without breaking connection
+local function sendErrorResponse(errorMsg)
+    local resp = { error = errorMsg }
+    local respStr = JSON.encode(resp)
+    local respLen = #respStr
+    
+    pcall(function()
+        Context.pipeServer.lock()
+        pcall(function()
+            Context.pipeServer.writeDword(respLen)
+            Context.pipeServer.writeString(respStr, false)
+        end)
+        Context.pipeServer.unlock()
+    end)
+end
+
+function Pipe.workerLoop()
+    Utils.debugPrint("Worker started")
+    local consecutiveErrors = 0
+
+    while Context.serverRunning do
+        local acceptOk, acceptErr = pcall(function()
+            Context.pipeServer.acceptConnection()
+        end)
+
+        if not acceptOk then
+            consecutiveErrors = consecutiveErrors + 1
+            if consecutiveErrors > Config.MAX_CONSECUTIVE_ERRORS then
+                Utils.debugPrint("Too many consecutive errors, restarting pipe...")
+                pcall(function() Context.pipeServer.destroy() end)
+                Context.pipeServer = createPipe(Config.PIPE_NAME, Config.PIPE_BUFFER_SIZE, Config.PIPE_BUFFER_SIZE)
+                consecutiveErrors = 0
+            end
+            if Context.serverRunning then
+                sleep(Config.HEARTBEAT_INTERVAL)
+            end
+        else
+            consecutiveErrors = 0
+            Context.connectionCount = Context.connectionCount + 1
+            Context.lastActivityTime = os_clock()  -- Heartbeat: record connection time
+            Utils.debugPrint("Client connected (#" .. Context.connectionCount .. ")")
+            
+            local sessionErrors = 0
+
+            while Context.serverRunning and Context.pipeServer and Context.pipeServer.Valid do
+                Utils.periodicCleanup()
+
+                -- Read size
+                local ok, size = false, nil
+                pcall(function()
+                    Context.pipeServer.lock()
+                    ok, size = pcall(Context.pipeServer.readDword)
+                    Context.pipeServer.unlock()
+                end)
+
+                if not ok or not size or size == 0 then
+                    sessionErrors = sessionErrors + 1
+                    if sessionErrors >= Config.MAX_SESSION_ERRORS then
+                        Utils.debugPrint("Too many session errors, disconnecting client")
+                        -- Send error before disconnecting
+                        sendErrorResponse("Too many consecutive read errors")
+                        break
+                    end
+                    sleep(10)
+                    goto continue
+                end
+
+                if size >= Config.MAX_MESSAGE_SIZE then
+                    Utils.debugPrint("Message too large: " .. size)
+                    sendErrorResponse("Message too large: " .. size .. " bytes (max: " .. Config.MAX_MESSAGE_SIZE .. ")")
+                    break
+                end
+
+                sessionErrors = 0
+
+                -- Read payload
+                local ok2, payload = false, nil
+                pcall(function()
+                    Context.pipeServer.lock()
+                    ok2, payload = pcall(Context.pipeServer.readString, size)
+                    Context.pipeServer.unlock()
+                end)
+
+                if ok2 and payload and #payload == size then
+                    local decodeOk, req = pcall(JSON.decode, payload)
+                    if not decodeOk or not req then
+                        Utils.debugPrint("Failed to decode JSON payload")
+                        sendErrorResponse("Invalid JSON payload")
+                        goto continue
+                    end
+                    
+                    local resp = nil
+
+                    -- Use optimized request execution (sync on demand)
+                    resp = Pipe.executeRequest(req)
+
+                    local respStr = JSON.encode(resp)
+                    local respLen = #respStr
+
+                    if respLen > Config.MAX_MESSAGE_SIZE then
+                        respStr = JSON.encode({ error = "Response too large" })
+                        respLen = #respStr
+                    end
+
+                    local writeOk = false
+                    pcall(function()
+                        Context.pipeServer.lock()
+                        writeOk = pcall(function()
+                            Context.pipeServer.writeDword(respLen)
+                            Context.pipeServer.writeString(respStr, false)
+                        end)
+                        Context.pipeServer.unlock()
+                    end)
+
+                    if writeOk then
+                        Context.lastActivityTime = os_clock()  -- Heartbeat: update on successful communication
+                    else
+                        Utils.debugPrint("Failed to write response")
+                        break
+                    end
+                else
+                    Utils.debugPrint("Failed to read payload: expected " .. size .. " bytes")
+                    sendErrorResponse("Failed to read payload: expected " .. size .. " bytes, got " .. tostring(#(payload or "")))
+                    -- Don't break, allow client to retry
+                    sleep(50)
+                end
+
+                ::continue::
+            end
+
+            pcall(function()
+                if Context.pipeServer and Context.pipeServer.Valid then
+                    Context.pipeServer.disconnect()
+                end
+            end)
+            Context.lastActivityTime = 0  -- Heartbeat: reset on disconnect
+            Utils.debugPrint("Client disconnected, recreating pipe for next connection...")
+            
+            -- Recreate pipe instance for next client (Windows named pipes are single-client)
+            pcall(function()
+                if Context.pipeServer then
+                    Context.pipeServer.destroy()
+                end
+            end)
+            Context.pipeServer = createPipe(Config.PIPE_NAME, Config.PIPE_BUFFER_SIZE, Config.PIPE_BUFFER_SIZE)
+            
+            if not Context.pipeServer or not Context.pipeServer.Valid then
+                Utils.debugPrint("Failed to recreate pipe, restarting worker loop...")
+                sleep(100)
+            else
+                Utils.debugPrint("Pipe recreated, ready for next connection")
+            end
+        end
+    end
+    Utils.debugPrint("Worker stopped")
+end
 
 -- ============ Server Lifecycle ============
 local Server = {}
@@ -7669,13 +7718,13 @@ function Server.stop()
     Utils.debugPrint("Server stopped (handled " .. Context.connectionCount .. " connections)")
 end
 
-function Server.start()
-    Server.stop()  -- This calls cleanupZombieState()
-
-    -- Additional cleanup for fresh start
-    Utils.debugPrint("Starting MCP Bridge")
-
-    Context.pipeServer = createPipe(Config.PIPE_NAME, Config.PIPE_BUFFER_SIZE, Config.PIPE_BUFFER_SIZE)
+function Server.start()
+    Server.stop()  -- This calls cleanupZombieState()
+
+    -- Additional cleanup for fresh start
+    Utils.debugPrint("Starting MCP Bridge")
+
+    Context.pipeServer = createPipe(Config.PIPE_NAME, Config.PIPE_BUFFER_SIZE, Config.PIPE_BUFFER_SIZE)
     if not Context.pipeServer or not Context.pipeServer.Valid then
         print("[CE-MCP] Failed to create pipe: " .. Config.PIPE_NAME)
         return false
@@ -7708,14 +7757,14 @@ function Server.stats()
         bpCount = bpCount + 1
     end
 
-    return {
-        running = Context.serverRunning,
-        connections = Context.connectionCount,
-        cached_symbols = symbolCacheCount,
-        cached_modules = moduleCacheCount,
-        active_breakpoints = bpCount
-    }
-end
+    return {
+        running = Context.serverRunning,
+        connections = Context.connectionCount,
+        cached_symbols = symbolCacheCount,
+        cached_modules = moduleCacheCount,
+        active_breakpoints = bpCount
+    }
+end
 
 -- ============ Global API ============
 -- Cleanup old instance
@@ -7734,18 +7783,18 @@ if CE_MCP_STATUS_LABEL then
     end)
 end
 
-CE_MCP = {
-    start = Server.start,
-    stop = Server.stop,
-    stats = Server.stats,
-    -- Logger API
-    Logger = Logger,
-    LogLevel = LogLevel,
-    -- Expose for debugging
-    _config = Config,
-    _context = Context,
-    _handlers = Handlers,
-}
+CE_MCP = {
+    start = Server.start,
+    stop = Server.stop,
+    stats = Server.stats,
+    -- Logger API
+    Logger = Logger,
+    LogLevel = LogLevel,
+    -- Expose for debugging
+    _config = Config,
+    _context = Context,
+    _handlers = Handlers,
+}
 
 CE_MCP_BRIDGE_INSTANCE = CE_MCP
 
@@ -7770,15 +7819,26 @@ function StatusLabel.create()
     label.Cursor = crHandPoint
 
     if commentBtn then
-        label.Parent = commentBtn.Parent
-        -- Anchor to CommentButton's left side
-        label.AnchorSideRight.Control = commentBtn
-        label.AnchorSideRight.Side = asrLeft
-        label.AnchorSideTop.Control = commentBtn
-        label.AnchorSideTop.Side = asrTop
-        label.Anchors = "[akTop,akRight]"
-        label.BorderSpacing.Right = 5
-        label.BorderSpacing.Top = 2
+        -- Use pcall to safely set properties, in case of unexpected parent/control issues
+        local ok = pcall(function()
+            label.Parent = commentBtn.Parent
+            -- Anchor to CommentButton's left side
+            label.AnchorSideRight.Control = commentBtn
+            label.AnchorSideRight.Side = asrLeft
+            label.AnchorSideTop.Control = commentBtn
+            label.AnchorSideTop.Side = asrTop
+            label.Anchors = "[akTop,akRight]"
+            label.BorderSpacing.Right = 5
+            label.BorderSpacing.Top = 2
+        end)
+        
+        if not ok then
+            -- Fallback if anchoring failed
+            label.Parent = mainForm
+            label.Anchors = "[akRight, akTop]"
+            label.Left = mainForm.ClientWidth - 120
+            label.Top = 5
+        end
     else
         -- Fallback: top right
         label.Parent = mainForm
@@ -7787,15 +7847,15 @@ function StatusLabel.create()
         label.Top = 5
     end
 
-    -- Click to show stats
-    label.OnClick = function()
-        local stats = Server.stats()
-        local connected = Context.lastActivityTime > 0 and
-                         (os_clock() - Context.lastActivityTime) < Config.HEARTBEAT_TIMEOUT
-        showMessage(string_format("CE MCP\nStatus: %s\nConnections: %d",
-            connected and "Connected" or "Waiting",
-            stats.connections or 0))
-    end
+    -- Click to show stats
+    label.OnClick = function()
+        local stats = Server.stats()
+        local connected = Context.lastActivityTime > 0 and
+                         (os_clock() - Context.lastActivityTime) < Config.HEARTBEAT_TIMEOUT
+        showMessage(string_format("CE MCP\nStatus: %s\nConnections: %d",
+            connected and "Connected" or "Waiting",
+            stats.connections or 0))
+    end
 
     StatusLabel.label = label
     StatusLabel.updateColor(false)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cheatengine",
-  "version": "5.8.26",
+  "version": "5.8.28",
   "description": "Cheat Engine MCP Server - AI-assisted reverse engineering bridge",
   "main": "ce_mcp_server.js",
   "bin": {

package/src/tool-registry.js

@@ -221,8 +221,8 @@ class ToolRegistry {
         new ToolParam('aob_string', 'string', "e.g. '48 89 5C 24 ?? 48 83 EC 20'", true),
         new ToolParam('module', 'string', "Limit scan to specific module for better performance (e.g. 'game.exe', 'UnityPlayer.dll')"),
         new ToolParam('protection', 'string', 'Flags like -C+X', false, '-C+X'),
-        new ToolParam('start', 'string', 'Start address (optional, use module instead for better performance)'),
-        new ToolParam('stop', 'string', 'Stop address (optional)'),
+        new ToolParam('start', 'string', 'Start address (optional). If module is not specified, this defines the start of the scan range.'),
+        new ToolParam('stop', 'string', 'Stop address (optional). If module is not specified, this defines the end of the scan range.'),
         new ToolParam('max_results', 'integer', 'Maximum results', false, 100),
       ]
     ));
@@ -233,6 +233,7 @@ class ToolRegistry {
       'USE WHEN: After ce_find_what_accesses returns a register value, search for that value to find pointer storage. ' +
       "Example: RBX=0x12345678 accessed your address -> scan for 0x12345678 (qword) -> find where pointer is stored. " +
       "NOT FOR: Finding game values like health/gold (use ce_scan_new for value hunting). " +
+      'Auto-aligns scan based on type for performance (4-byte for dword/float, 8-byte for qword/double). ' +
       'Returns: {count, results: [{address, symbol, isStatic}], value_searched, type, module}. ' +
       'TIP: isStatic=true means the address is in a module (potential static base found!).',
       'value_scan',
@@ -254,7 +255,7 @@ class ToolRegistry {
       '[VALUE HUNTING] Start scan session to find unknown addresses by observing value changes. ' +
       "USE WHEN: You don't know the address but can observe changes (health 100->95). " +
       "WORKFLOW: ce_scan_new -> change value in game -> ce_scan_next('decreased') -> repeat until few results. " +
-      'NOT FOR: Pointer tracing (use ce_value_scan). NOT FOR: Code patterns (use ce_aob_scan). ' +
+      'Auto-aligns scan based on type for performance (4-byte for dword/float, 8-byte for qword/double). ' +
       'Returns: {session_id, count}. Use ce_scan_next to filter, ce_scan_results to get addresses.',
       'scan_new',
       ToolCategory.SCANNING,