Sunday, 25 August 2013

Reading Memory with DLL base address

Reading Memory with DLL base address

I'm attempting to read a float within a process (a game).
Looking in Cheat Engine I can locate the address I need, however it's at
wow64cpu.dll + 4720, with an offset of 34.
As such I've tried finding the base address of the wow64cpu.dll in the
process, but this is where I'm confused.
I don't understand how to now use this address as all my attempts seem to
be way off.
Process[] processes = Process.GetProcessesByName("Napoleon");
Process process = processes[0];
ProcessModuleCollection modules = process.Modules;
ProcessModule dllBaseAdress = null;
foreach (ProcessModule i in modules)
{
if (i.ModuleName == "wow64cpu.dll")
{
dllBaseAdress = i;
break;
}
}
IntPtr dllPtr = dllBaseAdress.BaseAddress;
int pointer = dllPtr.ToInt32() + 0x4720;
int offset = 34;
IntPtr hProc = OpenProcess(ProcessAccessFlags.All, false,
process.Id);
int bytesRead;
byte[] buffer = new byte[4];
ReadProcessMemory(hProc, new IntPtr(pointer + offset), buffer, 4,
out bytesRead);
float lightColourScale = BitConverter.ToSingle(buffer, 0);
My question is where am I going wrong with the use of the base address of
the DLL, or perhaps elsewhere, I'm unsure how to use it to find my
address?
I've also compiled the program in x64 as otherwise it won't find the
wow64cpu.dll.
Thanks

1 comment:

  1. You should take action as soon as possible if you have an injury. Read on to learn what steps you need to take. You should also include any lost income.
    mrtechstreet.com |

    nashvillehomeportal.com |

    netechprep.com |

    njhomebrewsupply.com |

    northtexasautoplex.com |

    ReplyDelete