Read value of base pointer + offset

[xEviiLx]

I'm trying to read value of a base pointer + offset.

  Reveal hidden contents

Like:

address=process+number

offset are 2 or more

With only address I can easily the value but with base addres (pointer) I really don't know how I can do that.

  Reveal hidden contents

Now I'm not at home, when I back I give more details ^^"

Anyway im using NomadMemory (I think the lastest). 

 

Edited January 9, 2018 by xEviiLx

[water]

Could you please tell us which program you try to automate or which problem you try to solve.
Working with memory can get quite complex and most of the time there are easier and more reliable solutions available.

[xEviiLx]

  On 1/9/2018 at 8:31 AM, water said:

Could you please tell us which program you try to automate or which problem you try to solve.
Working with memory can get quite complex and most of the time there are easier and more reliable solutions available.

Expand  

Yeah, of course. In this moment I only want know how to use it -> with pointer. Personal curiosity 

(I know the rules)

[toto22]

Here, an old example that works for older auto-it versions.

 

expandcollapse popup

;#SingleInstance force


;#RequireAdmin
SetPrivilege("SetDebugPrivilege", 1)




$struct = DllStructCreate("dword")
DllStructSetData($struct, 1, 11)
$ptr = DllStructGetPtr($struct)



#include <NomadMemory2.au3>
#include <WindowsConstants.au3>
;#include <MsgBoxConstants.au3>

Opt("WinTitleMatchMode", -1)


;$staticOffset = Dec("000BB038")




$PID = WinGetProcess("s")
$sModule = "s.exe"
$StaticOffset = 0x000BB038
$ah_Handle = _MemoryOpen($PID)
$exeBaseAddr = _MemoryModuleGetBaseAddress($PID, $sModule) + $StaticOffset





dim $Offset[3] = [0, 0x0, "0x6F4"]

    $Process = _MemoryOpen(ProcessExists("s.exe"))
    If Not @error Then
        $value = _MemoryPointerRead($exeBaseAddr, $Process,$Offset)
        MsgBox(1,"",$value[1])

        _MemoryClose($Process)

    EndIf
    Sleep(100)