SplitScript reference / Process / scanOnce

Process.scanOnce

Method

Process.scanOnce(address: address, size: u64, signature: Signature) -> async address?

Scans one complete pass over a process-memory range.

Unlike Process.scan, this operation does not begin another pass when the signature is absent. It returns Some with the first matching address, or None after the entire requested range has been exhausted. The pass remains cooperative across ticks, skips windows that cannot be read, and is cancelled automatically when the process closes.

Use this when absence is meaningful, such as rejecting an unsupported executable. Use Process.scan when the signature may appear later and the operation should keep waiting.

Parameters

• address: The beginning of the range.
• size: The number of bytes to scan.
• signature: The compiled signature pattern.

Effects: allocates, reads process memory, requires an attached process, suspends, cancels when the process closes

Runtime behavior: available in suspending attachment code; suspends; cancels when the process closes

Examples

Reject an executable without the expected marker

let marker = await process.scanOnce(
    module.address,
    module.size,
    sig"48 8B ?? 89",
)
match marker {
    Some(address) => print(`marker at {address}`),
    None => print("unsupported executable"),
}