Cheat Engine

azfk · Cheater Reputation: 0 Joined: 26 May 2009 Posts: 37

I'm trying to copy a chunk of memory into a structure...

actually its a PE header, that i've loaded with globalalloc and readfile,

its all a random jumble of bytes

ex.

00 09 93 05 98 ... and so on

I want to copy it into a structure (which I know how the size and order goes)

do i use memcpy? I used it and I get weird results, like the first 2 bytes: MZ, i do something simple in a console to just see what i'm working with and get errors.

also, how are the endians arranged? I know they're backwards, or its automatically done for me?

Slugsnack · Posted: Sun Aug 23, 2009 5:07 am Post subject:

yes you could use memcpy

can you be a bit more clear about what is going wrong ? maybe post some code or something

x86 system uses little endian which means most significant byte is rightmost, and least significant leftmost

azfk · Cheater Reputation: 0 Joined: 26 May 2009 Posts: 37

Thanks, I meant lets take a look at the first 64 bytes, the dos header, even if I wasn't going to use it, I want to import it, so I've allocated a chunk of memory like so

file -> globalalloc -> readfile -> (void *)mem

so I initiate a struct like..

struct PE{
WORD magic
...};

struct PE dos_header;

....
....
memcpy(&dos_header,mem,64);

so after I do that, I can access dos_header like a regular structure?

dos_header.magic = 'MZ'

and so on?

smartz993 · Posted: Sun Aug 23, 2009 6:28 am Post subject:

Yes.

but there's no reason to set the "magic" property of the struct again, after you already copied the memory lol

oib111 · Posted: Sun Aug 23, 2009 7:34 am Post subject:

I think you should read up on the PE File Format a bit more. Iczelion has some excellent tutorials on it. But anyway, the DOS Header is composed of a IMAGE_DOS_HEADER structure, so you want to use an IMAGE_DOS_HEADER structure when accessing the DOS Header.

Slugsnack · Posted: Sun Aug 23, 2009 10:18 am Post subject:

to access it, you would typecast your pointer as a pointer to the above structure then yes, you would be able to access it normally

azfk · Cheater Reputation: 0 Joined: 26 May 2009 Posts: 37

Slugsnack · Posted: Sun Aug 23, 2009 2:33 pm Post subject:

okay what you need to do is get a pointer to PE header. then typecast that to IMAGE_NT_HEADERS*

access the .OptionalHeader of that which is an IMAGE_OPTIONAL_HEADER structure and your magic number, etc. etc. is right there

would you like an example in C ?

azfk · Cheater Reputation: 0 Joined: 26 May 2009 Posts: 37

Yeah, a code example would be nice,

EDIT: umm woops. I just remembered that the pe header starts 64 bytes after.

Thought i just realized that I shouldn't even allocate with GlobalAlloc, I just used malloc, I think I'm going to see if I can define the structures and just copy them using memmcpy, though I would appreciate the code.

Slugsnack · Posted: Mon Aug 24, 2009 4:44 am Post subject:

azfk · Cheater Reputation: 0 Joined: 26 May 2009 Posts: 37

tyvm slugsnack, eventually I did this last night:

Slugsnack · Posted: Mon Aug 24, 2009 9:27 am Post subject:

actually i'm a bit confused as to what you're actually doing. since you are using memcpy i assume the PE header is already mapped into memory in which case you can just do some typecasting and access the fields straight off

azfk · Cheater Reputation: 0 Joined: 26 May 2009 Posts: 37

Yes, it was mapped into memory, I didn't realize I could do that however until later