Cheat Engine

Metasploitable · How do I cheat? Reputation: 0 Joined: 29 Dec 2016 Posts: 6

Hi,

could some of you point me into the right direction of the following; I wrote a function for reading memory in Windows processes (Python, ctypes) so far it works with regular addresses for example '0x00AA5834' will return the correct value for what I'm looking for (I can confirm this works with Cheat Engine) However I need to return the value of a base adress starting with "somedll.dll" + 0x00AA5834 but I'm unsure how to do this in Python. So if any of you done something similar please let me know what you did and what the outcome was.

Code snippet for reading memory:

atom0s · Posted: Thu Dec 29, 2016 8:26 pm Post subject:

You will need to use some method of obtaining the base address of the given module name. Typically, this is done one of two ways:

- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

or using PSAPI methods:

- EnumProcesses
- EnumProcessModules
- GetModuleFileNameEx

If you are injected into the target process, you can simply use:
- GetModuleHandle

Metasploitable · How do I cheat? Reputation: 0 Joined: 29 Dec 2016 Posts: 6

atom0s · Posted: Fri Dec 30, 2016 12:40 pm Post subject:

Microsoft shows how to use the above API here:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms686701(v=vs.85).aspx

You need the module base address of client.dll.

Metasploitable · How do I cheat? Reputation: 0 Joined: 29 Dec 2016 Posts: 6

atom0s · Posted: Sat Dec 31, 2016 1:37 pm Post subject:

As you said above your address starts with:
"somedll.dll" + 0x00AA5834

So you would get the base address of "somedll.dll" like you just did, then add 0x00AA5834 to it as the starting point of what you are doing.

Metasploitable · How do I cheat? Reputation: 0 Joined: 29 Dec 2016 Posts: 6

atom0s · Posted: Sat Dec 31, 2016 11:44 pm Post subject:

Are you reading the addresses value after adding it together?

Metasploitable · How do I cheat? Reputation: 0 Joined: 29 Dec 2016 Posts: 6

ParkourPenguin · Posted: Sun Jan 01, 2017 9:10 pm Post subject:

I think it's too much of a coincidence that the value at 198E5834 is 198E5834. Are you sure you aren't looking at the address's value in CE and the address itself in your code?

(if by saying "client.dll + 0xAA5834 = 2CEDBCC0" you were implying client.dll was loaded at 2C43648C, that's impossible and you're probably looking at the value at the address client.dll + 0xAA5834 in CE)

Metasploitable · How do I cheat? Reputation: 0 Joined: 29 Dec 2016 Posts: 6

Thanks, I fixed it guys. I make a stupid mistake.. I did the calculation wrong. Confused