cheat-engine | 易学教程

How to get process's base address with MODULEENTRY32?

阅读更多关于 How to get process's base address with MODULEENTRY32?

问题 I'm looking to do something in this example: Python - How to get the start/base address of a process?. I'm having the same issue as the person in that topic, in that the pointers cheat engine provides is in reference to the base address of the process itself. I've looked around and it looks like the best solution is to use ctypes and the MODULEENTRY32 to store snapshots of processes and analyze their modBaseAddr. Here is my current code import os.path, ctypes, ctypes.wintypes from ctypes

C++ read memory addresses within process range only

阅读更多关于 C++ read memory addresses within process range only

问题 So I have been trying to get into memory reading in C++ and I thought a cool project would be to read all addresses a process is using (similar to how Cheat Engine works). I started by reading Link1: Read Memory of Process C++ Link2: Read memory of 64bit process address Link3: http://www.cplusplus.com/forum/general/42132/ And I also watched a tutorial on youtube where he explained how a process (game) worked with addresses. Link to youtube video: https://www.youtube.com/watch?v=wiX5LmdD5yk

Windows Virtual Address Space

阅读更多关于 Windows Virtual Address Space

问题 as I read here the virtual address space of a 32 bit Windows application has 2GB of storage (from 0x00000000-0x7FFFFFFF). The other 2GB are reserved for the system address space. But now I found a pointer in a 32bit program (using Cheat Engine) which is pointing to an address which isn't in range of the virutal address space. The addresses in my last exploration were 0x301DDC3C -> 0x87F56190 like you can see in the picture: (The expansion in the first line means a dereference of the pointer

c# multi-level pointers, memory reading

阅读更多关于 c# multi-level pointers, memory reading

问题 I found a code that works perfectly for static addresses. However, how would I change this code so it works for pointers? I need to get value from this pointer: 0x1002CAA70 + 0x10 + 0x18 + 0x0 + 0x18 . It is for 64 bit application. public class Program { private const int PROCESS_WM_READ = 0x0010; [DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); [DllImport("kernel32.dll")] public static extern bool

c/c++ how can i get base address of .exe running process?

阅读更多关于 c/c++ how can i get base address of .exe running process?

问题 Im looking for a method/function that i can use to get base address of "program.exe"+03262C08 -> B4895A0 . This address is from Cheat Engine and base address has been found with Pointer scanner. In pointer scanner i can press show module list and there is address of program.exe starting at address 00400000 program.exe . Pointer scanner was scanned for address 09c3000 (The address which i want to reach after base address+many offsets[the final address]). This address is base for certain object

JNA - EnumProcessModules() not returning all DLLs?

阅读更多关于 JNA - EnumProcessModules() not returning all DLLs?

问题 I trying to read coordinates from a game. This works perfectly fine, when using ReadProcessMemory on a HANDLE that I receive through OpenProcess, with the memory I find in CheatEngine. For example, if I know the float value in the running process is at 0x5AB38F68, I can read this. However, the address changes everytime the game restarts. It depends on a module called AkSoundEngine.dll. So basically the address would be at AkSoundEngine.dll+0x168F68. However, I cannot for the life of me find

JNA - EnumProcessModules() not returning all DLLs?

阅读更多关于 JNA - EnumProcessModules() not returning all DLLs?

Reading value stored in absolute memory address from python

阅读更多关于 Reading value stored in absolute memory address from python

问题 I used cheat engine to find an absolute address (See the attached image below) Memory address Now I would like to know how can I read the value which is "1" from an address which is "0x14340A654" I tried finding the same on StackOverflow and this is what I could gather. from ctypes import string_at from sys import getsizeof from binascii import hexlify a = 0x14340A654 print(hexlify(string_at(id(a), getsizeof(a)))) But this returns some gibberish like b

Using Pointers Found in Cheat Engine in C#

阅读更多关于 Using Pointers Found in Cheat Engine in C#

问题 About the Program I have a program which writes to the memory of the game I'm experimenting with. the code works for me just fine when I use a regular static address, but for some reason I can't seem to do it once I find a working pointer. For example, I find this in Cheat Engine after pointer scanning a few times: This address works every time I load the game and edit the value. The problem is I don't understand how to use it in my program. Here's my declared variables which I attempted to

Find an instruction in an executable file, given its address in a running process?

阅读更多关于 Find an instruction in an executable file, given its address in a running process?

I'm modifying an old abandonware game to have infinite lives. The Address that has the instruction dec ecx is not the same as its position in the .exe debugged. I remembered that an old friend of mine told me once that there was a formula to get the "true" address with the instruction inside the .exe. Cheat engine gives me the Memory Address. I remember that in the math formula, I needed to get the Module, in OllyDbg i get it. But i can't remember the formula. Somebody know how is that math formula? The formula it's very simple! There's another way to get the file position to permanently