Cheat Engine

[ecc72]

I'm trying to convert a pointer with offset in CE into python scripts, using pymem.

However the first base address of xxx.dll is different.
In ce, it looks like: xxx.dll + 0x 040DF480 = 0x 24FF2830A80
0x 24FF2830A80 + 0x 80 = 0x 24FF2830B00
[0x 24FF2830B00] = 100 (the right value)

IN python: I use pymem to locate the dll
pm = pymem.Pymem("abc.exe")
baseAddress = pymem.process.module_from_name(pm.process_handle, "xxx.dll").lpBaseOfDll

but it return baseaddress of xxx.dll is 0x7ffccac40000
They're totally different.

I lookup win's docs, it said the function return the load address of dll, not main function address? could It be the reason?

[Dark Byte]

it's the difference between an address and a value.

Looks like you're applying the math on the address and not the value of the address

[ecc72]

Oh. Thanks.
Suddenly, I know the reason after reading your words.
It's exactly address and value.
I didn't realized that the first offset from dll is also a pointer before.

[AkaPuppets]

Hey, sorry for necroing

I have the same problem and I do not understand the answer provided.

What do I need to do so I get the address and not the value?

Thanks