Memory reading help

[hounder]

alright, so ive search the forums for a bit and couldn't find a solution. heres my problem,

im creating an application that reads memory address and such from a game. by using cheat engine to scan for values, i get things like this,

now when i use "0x30477318" i have no problems. but i need to use the original address that cheat engine determines which is "Game.dll+557318". I've tried using the method posted with _MemoryModuleGetBaseAddress, but that doesn't seem to work. here is a snippet of the code im using,

$iPID = ProcessExists("SomeGame.bin")
$sModule = "Game.dll"
$StaticOffset = Dec("557318")
$dllbase = _MemoryModuleGetBaseAddress($iPID, $sModule) + $StaticOffset
If $dllbase = @error Then
_GUICtrlEdit_AppendText($Edit1,@CRLF & "" & "Failed to get memory module" & @CR)
Else
_GUICtrlEdit_AppendText($Edit1,@CRLF & "" & "Memory DLL Base Is:" & $dllbase & @CR)
EndIf

this returns a value of "5600024" which im pretty sure is not what im looking for.

if anyone can give me any insight on this i would be extremely grateful.

Edited August 16, 2009 by hounder

[hot202]

this is the problem that i have been having 2 hopw some 1 can work this out

[Belfigor]

http://www.autoitscript.com/forum/index.php?showtopic=78834&st=0&p=568869&#entry568869

try to look here

[hounder]

http://www.autoitscript.com/forum/index.php?showtopic=78834&st=0&p=568869&#entry568869

try to look here

this method seems to work with an exe, but not dll's. as i stated in my first post ive already tried the second method for dll's posted in that thread, but it doesnt seem to work.

[Szhlopp]

this method seems to work with an exe, but not dll's. as i stated in my first post ive already tried the second method for dll's posted in that thread, but it doesnt seem to work.

Hey man.

Without knowing the game, or having it to test off of. This should work:

$iPID = ProcessExists("SomeGame.bin") ; You really have a process called "XXX .BIN" ?
;Make sure the PID isn't 0. If it is 0, that's your problem

$StaticOffset = Dec("557318") ; Good

$dllbase = _MemoryModuleGetBaseAddress($iPID, "Game.dll") ; Just get the address here...

MsgBox(0, "", $dllbase) ; Does this say anything? if so, this function is working right

; if memory serves, $dllbase is an int. We convert it to an address by adding '0x' and the int dllbase and the int staticoffset
$dllbase = "0x" & Hex($dllbase + $StaticOffset)

; Voala? Hopefully...
MsgBox(0, "", $dllbase)

You may also want to look at my pointer AU3/CE converter. Writes all this code for you=)

Szh

[hounder]

Hey man.

Without knowing the game, or having it to test off of. This should work:

$iPID = ProcessExists("SomeGame.bin") ; You really have a process called "XXX .BIN" ?
;Make sure the PID isn't 0. If it is 0, that's your problem

$StaticOffset = Dec("557318") ; Good

$dllbase = _MemoryModuleGetBaseAddress($iPID, "Game.dll") ; Just get the address here...

MsgBox(0, "", $dllbase) ; Does this say anything? if so, this function is working right

; if memory serves, $dllbase is an int. We convert it to an address by adding '0x' and the int dllbase and the int staticoffset
$dllbase = "0x" & Hex($dllbase + $StaticOffset)

; Voala? Hopefully...
MsgBox(0, "", $dllbase)

You may also want to look at my pointer AU3/CE converter. Writes all this code for you=)

Szh

ive just tried this and im not sure its working correctly. the first value i get from $dllbase is 0, and after converting it into an address it returns 0x00557318. these are the same return values ive been getting after trying all the other methods listed on these forums. the $iPID isnt returning as 0 either, so im not sure what the problem is. unfortunately i cannot retrieve any pointers for this game since its protected (the proccess shuts down when attempting to debug, scan or dissamble).

and yes, the extension for the process is .bin

Edited August 16, 2009 by hounder

[hounder]

no one else has any ideas? >_

[BrettF]

Doesn't this use gameguard?

[hounder]

Doesn't this use gameguard?

it does, but it can be disabled pretty easily. hence why im using cheatengine.

[hot202]

yeah there is prob a bypass 4 it or something. have u worked this out yet?

[hounder]

yeah there is prob a bypass 4 it or something. have u worked this out yet?

no i havent found a solution yet. i really dont think gameguard is the issue either since its been disabled.

[hot202]

can any1 help with this?

[hounder]

bump, still not solved. still looking for a solution.