Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Memory Reading api's

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
ghmarko
Cheater
Reputation: 0

Joined: 31 Jan 2020
Posts: 28
Location: 192.168.0.1

PostPosted: Mon Mar 30, 2020 8:49 am    Post subject: Memory Reading api's Reply with quote

can anyone here give me a list of api's used for memory reading ?
Back to top
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger
atom0s
Moderator
Reputation: 154

Joined: 25 Jan 2006
Posts: 7941
Location: 127.0.0.1

PostPosted: Mon Mar 30, 2020 2:22 pm    Post subject: Reply with quote

Finding the process:
- FindWindow (to find based on window name or window class.)
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

PSAPI has its own set of API that does the same stuff as well:
https://docs.microsoft.com/en-us/windows/win32/psapi/psapi-functions

Opening the process:
- OpenProcess

Memory related:
- ReadProcessMemory
- WriteProcessMemory
- VirtualAllocEx
- VirtualProtectEx
- VirtualQueryEx

And so on, these are the main ones that are the most commonly used from a trainer standpoint that is external and from usermode.

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ghmarko
Cheater
Reputation: 0

Joined: 31 Jan 2020
Posts: 28
Location: 192.168.0.1

PostPosted: Mon Mar 30, 2020 2:30 pm    Post subject: Reply with quote

atom0s wrote:
Finding the process:
- FindWindow (to find based on window name or window class.)
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

PSAPI has its own set of API that does the same stuff as well:
https://docs.microsoft.com/en-us/windows/win32/psapi/psapi-functions

Opening the process:
- OpenProcess

Memory related:
- ReadProcessMemory
- WriteProcessMemory
- VirtualAllocEx
- VirtualProtectEx
- VirtualQueryEx

And so on, these are the main ones that are the most commonly used from a trainer standpoint that is external and from usermode.

the game anticheat detect memory changing i need to know api's used for that (internal)
Back to top
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger
DanyDollaro
Master Cheater
Reputation: 2

Joined: 01 Aug 2019
Posts: 300
Location: Italy

PostPosted: Mon Mar 30, 2020 4:47 pm    Post subject: Reply with quote

Check if there are codes that act on reading the section of code you are using to redirect the thread (the injection point).
Normally you can solve it with a "stealth edit" or bypassing the integrity check.
Back to top
View user's profile Send private message
ghmarko
Cheater
Reputation: 0

Joined: 31 Jan 2020
Posts: 28
Location: 192.168.0.1

PostPosted: Tue Mar 31, 2020 5:48 am    Post subject: Reply with quote

DanyDollaro wrote:
Check if there are codes that act on reading the section of code you are using to redirect the thread (the injection point).
Normally you can solve it with a "stealth edit" or bypassing the integrity check.

i know but iam using c++ cant use stealthedit Crying or Very sad Crying or Very sad
Back to top
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger
OldCheatEngineUser
Whateven rank
Reputation: 17

Joined: 01 Feb 2016
Posts: 1543

PostPosted: Tue Mar 31, 2020 10:27 am    Post subject: Reply with quote

https://forum.cheatengine.org/faq.php#1

note:
regardless of what API's you are using and whether they are usemode or kernelmode API's, if the game is shipped with a built-in integrity-check then none of the API's will help.

(if no integrity-check then yes some API's can help, but again CEF have some rules so check the FAQ)

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Back to top
View user's profile Send private message Visit poster's website
atom0s
Moderator
Reputation: 154

Joined: 25 Jan 2006
Posts: 7941
Location: 127.0.0.1

PostPosted: Tue Mar 31, 2020 11:37 pm    Post subject: Reply with quote

ghmarko wrote:
atom0s wrote:
Finding the process:
- FindWindow (to find based on window name or window class.)
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

PSAPI has its own set of API that does the same stuff as well:
https://docs.microsoft.com/en-us/windows/win32/psapi/psapi-functions

Opening the process:
- OpenProcess

Memory related:
- ReadProcessMemory
- WriteProcessMemory
- VirtualAllocEx
- VirtualProtectEx
- VirtualQueryEx

And so on, these are the main ones that are the most commonly used from a trainer standpoint that is external and from usermode.

the game anticheat detect memory changing i need to know api's used for that (internal)


You can try using the 'NT' versions of the functions, if those are detected as well then you either need to learn how to bypass the anti-cheat or create a driver.

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites