Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[C#][Game Trainer] Base Address of a 64-bit process

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
arlightOne
How do I cheat?
Reputation: 0

Joined: 27 Sep 2015
Posts: 7
PostPosted: Sun Sep 27, 2015 6:09 pm    Post subject: [C#][Game Trainer] Base Address of a 64-bit process Reply with quote
Hello!

Been going about trying to make my own trainer using CE and Visual Studio C#.
The game in particular I've been trying to make a trainer of is Mortal Kombat X/10. I do believe I picked the wrong game to try making my first trainer because it appears MK10 runs only as a 64-bit process,

Anyway, my question with regards to how C# and memory access to you all is:
Is there any way to find the base address of a 64-bit process within C#.

I have a basic pointer I found using CE
Code:
"MK10 . exe"+03039D28
0x18, 0x588, 0x68, 0xA0, 0x420 etc .


My problem is that "MK10 . exe" portion of it as I can't seem to implement a way to acquire that (very) base location of the process.
The reason I have been unsuccessful thus far is, within Visual Studio (2015), it appears using "myProcess[0] . MainModule . BaseAddress . ToInt32()" makes a win32 exception that states:
Quote:
An unhandled exception of type 'System . ComponentModel . Win32Exception' occurred in System . dll

Additional information: A 32 bit processes cannot access modules of a 64 bit process.


Here's just a portion of the code I have (taken from a tutorial I have been following):

Code:
 #region UnlimitedHealth
                if (UnlimitedHealthP1)
                {
                    myMemory.ReadProcess = myProcess[0];
                    myMemory.Open();
                    //int pointerAddress = HexToDec(HealthPointerP1);
                    int pointerAddress = myProcess[0].MainModule.BaseAddress.ToInt32() + 0x03039D28;
                    int[] pointerOffset1 = HealthOffsetP1;
                    int bytesWritten;
                    byte[] valueToWrite = BitConverter.GetBytes(HealthToKeepP1);
                    string writtenAddress = myMemory.PointerWrite((IntPtr)pointerAddress, valueToWrite, pointerOffset1, out bytesWritten);
                    myMemory.CloseHandle();
                   
                }
                #endregion


Any assistance on this matter would very helpful!

Thanks in advance.
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278
PostPosted: Sun Sep 27, 2015 8:45 pm    Post subject: Reply with quote
Did you try?
myProcess[0].MainModule.BaseAddress.ToInt64()

Or
IntPtr address = IntPtr.Add(myProcess[0].MainModule.BaseAddress, 0x03039D28)
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 470

Joined: 09 May 2003
Posts: 25796
Location: The netherlands
PostPosted: Sun Sep 27, 2015 8:48 pm    Post subject: Reply with quote
Instead of building for "any cpu" add a new build target for x64 specifically and use that
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
arlightOne
How do I cheat?
Reputation: 0

Joined: 27 Sep 2015
Posts: 7
PostPosted: Sun Sep 27, 2015 8:55 pm    Post subject: Reply with quote
I have tried replacing ToInt32 to ToInt64 before, yes, but I get an error (was going to post a pic, but it would not allow me):

Quote:
"Cannot implicitly convert type 'long' to 'int'. An explicit conversion exists (are you missing a cast?)"


This is where my limited C# knowledge hits its peak, unfortunately.
Conversion of long to int types.

Dark Byte wrote:
Instead of building for "any cpu" add a new build target for x64 specifically and use that


I have changed my 'platform' under the 'configuration manager' to x64 directly and enabled as build.

Received a different error, same line, so presumably related to previous one:

Code:
An unhandled exception of type 'System.OverflowException' occurred in mscorlib.dll

Additional information: Arithmetic operation resulted in an overflow.


EDIT: I have renamed the line into a long type integer. Long support 64 bit storage. I have also taken the suggestion to have "ToInt64()" as conversion.

It seems to have fixed the issue, but now I'm fighting with my other classes to switch them all also over to support 64-bit with long types.

Thanks!
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278
PostPosted: Sun Sep 27, 2015 10:26 pm    Post subject: Reply with quote
Probably should follow my second suggestion and turn everything into IntPtr instead of trying to use int or long.
Back to top
View user's profile Send private message
arlightOne
How do I cheat?
Reputation: 0

Joined: 27 Sep 2015
Posts: 7
PostPosted: Mon Sep 28, 2015 7:57 pm    Post subject: Reply with quote
Zanzer wrote:
Probably should follow my second suggestion and turn everything into IntPtr instead of trying to use int or long.


Thanks! I took your suggestion and did IntPtr instead!

After the rewrite I was able to get it running properly, but a new issue arose: another overflow due to several more "ToInt32()."

I've got this code block below that's seeing an error at the two lines containing "ToInt32()," marked as "***Error***"

Code:
public string PointerWrite(IntPtr MemoryAddress, byte[] bytesToWrite, int[] Offset, out IntPtr bytesWritten)
        {
            int iPointerCount = Offset.Length - 1;
            IntPtr ptrBytesWritten;
            bytesWritten = 0;
            byte[] buffer = new byte[4]; //DWORD to hold an Address
            int tempAddress = 0;

            if (iPointerCount == 0)
            {
                MemoryAPI.ReadProcessMemory(m_hProcess, MemoryAddress, buffer, 4, out ptrBytesWritten);
                tempAddress = Addr.ToDec(Addr.Make(buffer)) + Offset[0]; //Final Address
                MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, out ptrBytesWritten);

                bytesWritten = ptrBytesWritten.ToInt32();//***ERROR***
                return Addr.ToHex(tempAddress);
            }

            for (int i = 0; i <= iPointerCount; i++)
            {
                if (i == iPointerCount)
                {
                    MemoryAPI.ReadProcessMemory(m_hProcess, (IntPtr)tempAddress, buffer, 4, out ptrBytesWritten);
                    tempAddress = Addr.ToDec(Addr.Make(buffer)) + Offset[i]; //Final Address
                    MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, out ptrBytesWritten);

                    bytesWritten = ptrBytesWritten.ToInt32();***ERROR***
                    return Addr.ToHex(tempAddress);
                }
                else if (i == 0)
                {
                    MemoryAPI.ReadProcessMemory(m_hProcess, MemoryAddress, buffer, 4, out ptrBytesWritten);
                    tempAddress = Addr.ToDec(Addr.Make(buffer)) + Offset[i];
                }
                else
                {
                    MemoryAPI.ReadProcessMemory(m_hProcess, (IntPtr)tempAddress, buffer, 4, out ptrBytesWritten);
                    tempAddress = Addr.ToDec(Addr.Make(buffer)) + Offset[i];
                }
            }


Again, I apologize for my (very) limited knowledge-base of C#.
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278
PostPosted: Mon Sep 28, 2015 8:48 pm    Post subject: Reply with quote
Wonder if it should be something like:
Code:
uint written = 0;
MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, ref written);

Did you change bytesWritten to an IntPtr? I don't think you should've changed that one.
Back to top
View user's profile Send private message
arlightOne
How do I cheat?
Reputation: 0

Joined: 27 Sep 2015
Posts: 7
PostPosted: Tue Sep 29, 2015 7:45 am    Post subject: Reply with quote
Zanzer wrote:
Wonder if it should be something like:
Code:
uint written = 0;
MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, ref written);

Did you change bytesWritten to an IntPtr? I don't think you should've changed that one.


Actually the code had already declared it as IntPtr. I'm following a tutorial and this memoryAPI was provided. It would probably help to have a better understanding of C# before editing it, I know, but I'm attempting to understand it as I go.

In any case, I'll try to use the code you provided, just not sure what to do with it at this point.
Thanks!

EDIT: Ok, have tried playing around with this code, placing it at different location in the class, but I guess I don't understand the purpose of it enough to really make use. Any suggestions or tips?
Back to top
View user's profile Send private message
arlightOne
How do I cheat?
Reputation: 0

Joined: 27 Sep 2015
Posts: 7
PostPosted: Tue Sep 29, 2015 9:15 pm    Post subject: Reply with quote
Where/what do I replace with what was suggested?

Code:
uint written = 0;
MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, ref written);


Apologies for the double post
Back to top
View user's profile Send private message
n0psl3d
How do I cheat?
Reputation: 0

Joined: 30 Sep 2015
Posts: 6
Location: Twin Cities, MN
PostPosted: Wed Sep 30, 2015 3:18 pm    Post subject: Reply with quote
Zanzer wrote:
Wonder if it should be something like:
Code:
uint written = 0;
MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, ref written);

Did you change bytesWritten to an IntPtr? I don't think you should've changed that one.


The idea is that he wants to essentially "return" the value of bytesWritten via passing by its reference... This is how writeprocessmemory is already implemented as well. Otherwise he wouldn't be able to retrieve both it, and the address string value in his method.

However, it's fairly troublesome that there's a lack of understanding of basic datatypes... Since he is working with a 64bit process, then his virtual address space is also in 64bit addressing. So he needs long (64 bit) integers to store these values, if he does not, there will be overflow... (AKA adding too much to the data storage that bits will overflow their container).

I feel like googling the errors he mentioned would've shown up with these results.
Back to top
View user's profile Send private message
arlightOne
How do I cheat?
Reputation: 0

Joined: 27 Sep 2015
Posts: 7
PostPosted: Wed Sep 30, 2015 7:28 pm    Post subject: Reply with quote
n0psl3d wrote:
Zanzer wrote:
Wonder if it should be something like:
Code:
uint written = 0;
MemoryAPI.WriteProcessMemory(m_hProcess, (IntPtr)tempAddress, bytesToWrite, (uint)bytesToWrite.Length, ref written);

Did you change bytesWritten to an IntPtr? I don't think you should've changed that one.


The idea is that he wants to essentially "return" the value of bytesWritten via passing by its reference... This is how writeprocessmemory is already implemented as well. Otherwise he wouldn't be able to retrieve both it, and the address string value in his method.

However, it's fairly troublesome that there's a lack of understanding of basic datatypes... Since he is working with a 64bit process, then his virtual address space is also in 64bit addressing. So he needs long (64 bit) integers to store these values, if he does not, there will be overflow... (AKA adding too much to the data storage that bits will overflow their container).

I feel like googling the errors he mentioned would've shown up with these results.


That's precisely what's been going on! I do somewhat understand the datatypes available and what they store for the given parameter. Problem is, I don't really understand the mechanics of reading the 64-bit process's base address value and adding offsets in the format of hex.

The overflows occur at nearly every step along the way because the code and memory class I obtained is adapted to a max of 32-bit/int value containers.

I have very much tried googling this issue into oblivion, believe me. There doesn't seem to be too much out there as far as tutorials for game trainers in C# for 64-bit games such as MKX. I've been struggling with it the past week or so and have only recently decided to ask for assistance on it.
Back to top
View user's profile Send private message
ezgamesplz
How do I cheat?
Reputation: 0

Joined: 15 Oct 2016
Posts: 1
PostPosted: Sat Oct 15, 2016 10:31 am    Post subject: Did you figure this out? Reply with quote
Did you manage to figure this out? I can write to static addresses but I can't write to pointer addresses. When I try and debug it seems like it is not reading a correct value when applying offsets. I found a value for where the game is in memory but still no luck :-/
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites