View previous topic :: View next topic |
Author |
Message |
iPromise Grandmaster Cheater
Reputation: -1
Joined: 27 Jun 2009 Posts: 529 Location: Canada
|
Posted: Wed Nov 25, 2009 7:18 pm Post subject: [URGENT] Static Addresses |
|
|
I'm currently coding a memory scanner, my question is while i'm scanning through the addresses, how do I know which address is static and if it is, its equation, for example; GAME.exe + 0x00400000?
|
|
Back to top |
|
 |
lurc Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006 Posts: 1900
|
Posted: Wed Nov 25, 2009 8:35 pm Post subject: |
|
|
Uhh I think it was like if the memory is located within any of the headers (eg. .code) it would be static?
Can't remember... gotta start reversing again.
_________________
|
|
Back to top |
|
 |
Slugsnack Grandmaster Cheater Supreme
Reputation: 71
Joined: 24 Jan 2007 Posts: 1857
|
Posted: Thu Nov 26, 2009 10:19 am Post subject: |
|
|
telling if it's static >> http://forum.cheatengine.org/viewtopic.php?t=469510
also find what module that address is in, then get a pointer to that module's base. then the difference is your offset. at first glance i might traverse the modules using system snapshots but i think there is a function for the lookup of an address in a module.. forgotten what it is for the time though
one way in the past that i identified static or not was a heapalloc + malloc + virtualalloc, etc. etc. etc. hook.
dark byte's way is a lot better for the purpose you're going for though. i did my method because i also needed the base of allocation for each dynamic address i had
|
|
Back to top |
|
 |
iPromise Grandmaster Cheater
Reputation: -1
Joined: 27 Jun 2009 Posts: 529 Location: Canada
|
Posted: Fri Nov 27, 2009 5:13 pm Post subject: |
|
|
So, for example:
Code: |
HMODULE Handle;
GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, 0x00400000 (example), &Handle);
|
For the second parameter I put an address because:
Code: |
or a pointer to an address in the module (if dwFlags is GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS). | - MSDN
Is this right?
|
|
Back to top |
|
 |
|