Jump to content

MemoryRead is not working!


kennyvo
 Share

Recommended Posts

I use CE to find the pointer and I get results like this

Posted Image

Pointer: ElementClient.exe+5C7A54

Offset: 28

my code

#include <NomadMemory.au3>
SetPrivilege("SeDebugPrivilege", 1)
...
$pid = WinGetProcess($handle)
$openmem = _MemoryOpen($pid)
$offset = Dec("5C7A54")

$baseADDR = _MemoryGetBaseAddress($openmem, 1);Return 3276800
$FinalStatic = "0x" & Hex($baseADDR + $offset);Return 0x008E7A54
$final_value=_MemoryRead($FinalStatic,$openmem);Return 389

Func _MemoryGetBaseAddress($ah_Handle, $iHexDec = 0)
    Local $iv_Address = 0x00100000
    Local $v_Buffer = DllStructCreate('dword;dword;dword;dword;dword;dword;dword')
    Local $vData
    Local $vType
    
    If Not IsArray($ah_Handle) Then
        SetError(1)
        Return 0
    EndIf
    

    DllCall($ah_Handle[0], 'int', 'VirtualQueryEx', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer))
    
    If Not @Error Then
        
        $vData = Hex(DllStructGetData($v_Buffer, 2))
        $vType = Hex(DllStructGetData($v_Buffer, 3))
        
        While $vType <> "00000080"
            DllCall($ah_Handle[0], 'int', 'VirtualQueryEx', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer))
            $vData = Hex(DllStructGetData($v_Buffer, 2))
            $vType = Hex(DllStructGetData($v_Buffer, 3))
            If Hex($iv_Address) = "01000000" Then ExitLoop
            $iv_Address += 65536
            
        WEnd

        If $vType = "00000080" Then
            SetError(0)
            If $iHexDec = 1 Then
                Return Dec($vData)
            Else
                Return $vData
            EndIf
            
        Else
            SetError(2)
            Return 0
        EndIf
        
    Else
        SetError(3)
        Return 0
    EndIf
    
EndFunc

but in game it is different. who have to help me to find the corect add?

Edited by kennyvo
Link to comment
Share on other sites

I use CE to find the pointer and I get results like this

Posted Image

Pointer: ElementClient.exe+5C7A54

Offset: 28

my code

#include <NomadMemory.au3>
SetPrivilege("SeDebugPrivilege", 1)
...
$pid = WinGetProcess($handle)
$openmem = _MemoryOpen($pid)
$offset = Dec("5C7A54")

$baseADDR = _MemoryGetBaseAddress($openmem, 1);Return 3276800
$FinalStatic = "0x" & Hex($baseADDR + $offset);Return 0x008E7A54
$final_value=_MemoryRead($FinalStatic,$openmem);Return 389
Edited by DllParse
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...