Jump to content
Sign in to follow this  
maestro

static "dynamic" memory addresses

Recommended Posts

maestro

Hi, I've run into a snag with an application I'm working on.

I need to be able to change the value of an (4 byte) address of a process.

Now finding the address on cheat engine isn't a problem, and it IS a static address, So each time I run cheat engine it finds it each time no problem. What I've realized is the address (although static) seems to change each time.

After further investigating the cause I came across this: "client.dll+4C38A8" which is how cheat engine is able to change the address each time when the application is opened.

So my question is, is it possible to replicate how cheat engine finds the "new" static address using AutoIT.

I'm using nomadmemory.au3 to get the information from the process.

Thanks,

Ilmaestro.


Hello, World!... LAME lol

Share this post


Link to post
Share on other sites
maestro

So far, I've been trying stuff such as:

$dll = DllOpen("client.dll")
$result = DllCall($dll, "int", "DWORD")
MsgBox(0,"",$result)
DllClose($dll)

or other stuff like

$clientDLL = _MemoryOpen(ProcessExists ( "client.dll" ));
;obviously this didn't work, was just experimenting.

Anyways, if anyone knows of another way that would actually work, that would be awesome.

Thanks,

Ilmaestro


Hello, World!... LAME lol

Share this post


Link to post
Share on other sites
maestro

Thank you for the reply, I've taken a look at it, and it seems that it doesn't work on a dll, just the exe. Unless my syntax is just wrong.

If anyone knows how to convert the suggestion on the link in the previous post to work with a dll, please let me know.

Thanks,

Ilmaestro


Hello, World!... LAME lol

Share this post


Link to post
Share on other sites
maestro

This is what I tried:

$ID=_MemoryOpen(ProcessExists("application.exe"))
$iPID = WinGetProcess("client")
$sModule = "client.dll"
MsgBox(0,"",$iPID)
$iOffset = 0x004C38A8
$baseADDR = _MemoryModuleGetBaseAddress($iPID, $sModule) + $iOffset
MsgBox(0,"",$baseADDR)
 ;_MemoryWrite($BaseADDR, $ID, 550)
 ;_MemoryClose($iPID)

using the suggestion on the 2nd page of the link, however, no luck.

Does anyone have any other ideas?

Thanks,

Ilmaestro


Hello, World!... LAME lol

Share this post


Link to post
Share on other sites
maestro

I've been looking all night, and nothing I've found seems to work, is it even possible in AutoIT, or am i wasting me time, also if anyone has a C++ alternative they could post, I'm just starting to lean C++, so that could be useful as well.

Thanks,

Ilmaestro


Hello, World!... LAME lol

Share this post


Link to post
Share on other sites
maestro

After reading some more I found how to find the hex value of the dll, for anyone else who is trying to do the same thing, if using cheat engine you have to click view memory, then click view, then click on Enumerate DLL's. then scroll down and find the one your looking for. Now my question still stands, is it possible to find the enumerated value of a dll being used by a specific Process. I can get it to add the Hex dll value and the offset together no problem.

So basically I need a way to:

1. Find the dll loaded into a specific exe.

2. Find the hex for the specified dll.

3. Be able to export it into a variable.

If anyone knows if this for a fact possible, please let me know so I can give up on my search.

Thanks,

Ilmaestro.


Hello, World!... LAME lol

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.