Memory-Hacking-Class icon indicating copy to clipboard operation
Memory-Hacking-Class copied to clipboard

Different base address then process

Open CrimsonMiralis opened this issue 4 years ago • 3 comments

This isn't an issue with your code but I had a question on its functionality and wasn't sure how else to ask you, I have a bit of an interesting situation. My base address isn't the games .exe, since its code loaded through a .dll. So basically I need to connect to my games .exe like normal, but I need to get the value at address game.dll + 0x4394 for example

Can I do this with your code? Can you provide an example of doing this?

CrimsonMiralis avatar Jan 28 '21 08:01 CrimsonMiralis

Maybe like this?

#include "Memory.hpp"
using std::string;

int main() {
    SetConsoleTitle("Memory Class Test");
    char* TARGET_PROCESS_NAME = "League of Legends.exe";
    char* TARGET_MODULE_NAME = "game.dll";
    
    HANDLE processHandle;
    int baseAddress;
    
    //////////////////////////////////////////////////////////////////////////////////
    /* Note: These pointers/offsets are probably outdated by the time you read this */
    
    int GAME_VERSION_MODULE_OFFSET = 0x2A1D738;
    
    int PLAYERS_MODULE_OFFSET = 0x1DAAED4;
        int HEALTH_OFFSET = 0x124;
        int MANA_OFFSET = 0x190;
        
    //////////////////////////////////////////////////////////////////////////////////
    
    Memory Memory;
    Memory.GetDebugPrivileges();
    processId = Memory.GetProcessId(TARGET_PROCESS_NAME);
    processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
    
    baseAddress = Memory.GetModuleBase(processHandle, (string)TARGET_MODULE_NAME);
    std::cout << "Base address for module \"" << TARGET_MODULE_NAME << "\" is " << baseAddress << " (in dec)..."<< std::endl;
    
    int playersAddress =     baseAddress + PLAYERS_MODULE_OFFSET;
    int gameVersionAddress = baseAddress + GAME_VERSION_MODULE_OFFSET;
    
    int ptrOffset[] = {0x0}; //0x0 offset is for player one. 0x4 would be player 2 etc
    int playerOneAddress = Memory.ReadPointerInt(processHandle, playersAddress, ptrOffset, 1);
    
    float playerOneHealth = Memory.ReadFloat(processHandle, playerOneAddress + HEALTH_OFFSET);
    float playerOneMana =   Memory.ReadFloat(processHandle, playerOneAddress + MANA_OFFSET);
    
    string gameVersion = Memory.ReadText(processHandle, gameVersionAddress);
    
    std::cout << "Game version: " << gameVersionAddress << std::endl;
    std::cout << "Player one has " << playerOneHealth << " health!" std::endl;
    std::cout << "Player one has " << playerOneMana << " mana!" std::endl;
    
    cin.get();
    return 0;
}

I only added the TARGET_MODULE_NAME variable and used it for GetModuleBase.

T-vK avatar Jan 28 '21 09:01 T-vK

Doesn't seem to appear to be able to recognize the module, it just ends up with a base address of -1. Unless I'm doing this wrong, baseAddress spits out "-1", and in turn HPAddress spits out "1799", 0x4394 = 17300. So its the base address of -1 + 0x4394 which is ending up just looking at 1799

I have confirmed that its opening and reading the memory of the game properly if I use the .exe or set the address to where I need +1

char* TARGET_PROCESS_NAME = "game.exe"; //game.exe
char* TARGET_MODULE_NAME = "game.dll"; //module I need base address of
HANDLE processHandle;
int baseAddress;
int HP_Loc = 0x4394; //offset of module base address
Memory Memory;
Memory.GetDebugPrivileges();
int processId = Memory.GetProcessId(TARGET_PROCESS_NAME);
processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
baseAddress = Memory.GetModuleBase(processHandle, (string)TARGET_MODULE_NAME);
int HPAddress = baseAddress + HP_Loc;
int HP = Memory.ReadInt(processHandle, HPAddress);

CrimsonMiralis avatar Jan 28 '21 17:01 CrimsonMiralis

Maybe there is a bug in the GetModuleBase method. I'm not sure if I ever tested it with a different module than the exe itself. You could try to debug it by printing the szBuf variable here:

https://github.com/T-vK/Memory-Hacking-Class/blob/183c90070820ad57734904edc5fcd1f6566f23b8/Memory.cpp#L40

T-vK avatar Jan 29 '21 00:01 T-vK