Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


How do I find the base address of another running process?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
Videogamer555
How do I cheat?
Reputation: 0

Joined: 24 Oct 2019
Posts: 2

PostPosted: Thu Oct 24, 2019 11:25 pm    Post subject: How do I find the base address of another running process? Reply with quote

I can use the process's ProcessID with OpenProcess to get a handle. However, I want to know the image base address of that process, in that process's virtual memory space. For example, if program XYZ.exe has its image base (first byte of the EXE file) at address 0x500000 in its virtual memory space, how do I go about discovering that 0x500000 is in fact the address. Going into this problem I won't know that it's 0x500000. I just picked that number for this example. I need a way of doing it.

An ugly, and not-at-all-elegent way would be to use something to find the path of the EXE file on the harddrive that coresponds to the process in question. There are API functions I can use to find the file of a process, once I have a handle to the process. Then I can open the EXE file and parse its header to find its image base address. But I want to avoid that. That seems like a lot of steps for a simple thing.

Is there an API function that DIRECTLY returns the base address of that process's image (in-memory copy of the EXE file), if I feed the process's handle to one of that function's parameters?
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 151

Joined: 25 Jan 2006
Posts: 7819
Location: 127.0.0.1

PostPosted: Thu Oct 24, 2019 11:37 pm    Post subject: Reply with quote

- CreateToolhelp32Snapshot
- Module32First / Module32Next

The first module returned will be the main object of the process.

You can also use PSAPI functions instead.

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites