| View previous topic :: View next topic |
| Author |
Message |
darkpoet24
How do I cheat?
![]() Reputation: 0
Joined: 13 Feb 2012
Posts: 2
|
 Posted: Mon Feb 13, 2012 8:18 pm Post subject: Different module addresses in CE vs .NET (resolved) |
 |
|
I seriously hate asking for help but I'm stumped after two weeks of trying. I'm referencing a pointer in a loaded DLL module. In Cheat Engine it looks like this:
"MemoryMan.dll"+0002D3CC which points to a dynamic address e.g. 0AA50000
I load up my C# app and pull the programs base address, entry point, and do the same thing for the module DLL's base address, entry point.
I add the offset (0002D3CC) but it never matches what CE says it's pointing too. It's driving me nuts. I've tried numerous different ways to pull the module process ID but nothing works.
I've tried calling the kernel.dll calls for GetNextProcess, GetFirstProcess (or whatever) and it returns the same of my current method of using System.Diagnostics.ProcessModule.
How can I figure this out? I'm at the point of tearing out my hair... lol...
Here's pieces of the code I'm using:
| Code: | public int BaseAddress(string sModuleName)
{
try { return FindModule(sModuleName).BaseAddress.ToInt32(); }
catch { return 0; }
}
private ProcessModule FindModule(string sModuleName)
{
for (int iModule = 0; iModule < mReadProcess.Modules.Count; iModule++)
{
if (mReadProcess.Modules[iModule].ModuleName == sModuleName)
return mReadProcess.Modules[iModule];
}
return null;
}
|
Same sorta thing for the entry point. Like I've said I've tried different methods and they all turn out the same numbers so I'm missing something fundamental.
How is CE determining what the address of the module (DLL) is? How in the name of hacking can I fix this?
If there's any more information you need please let me know... If I get a working solution I'll PayPal the first one I can implement $10.00 USD.
Bribery = Win?
Heres the visual:
i42.tinypic (dot) com/289dlad.jpg
Last edited by darkpoet24 on Mon Feb 13, 2012 9:11 pm; edited 1 time in total |
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 475
Joined: 09 May 2003
Posts: 25976
Location: The netherlands
|
| Posted: Mon Feb 13, 2012 8:30 pm Post subject: |
|
|
Note the text "This pointer points to address 0aa50000"
That means that the address at "MemoryMan.dll"+0002D3CC contains the value 0aa50000, not that "MemoryMan.dll"+0002D3CC IS 0aa500000
To confirm:
In cheat engine go to memoryview, hexview. Rightclick and select goto address
Fill in the address "MemoryMan.dll"
The address should now match the address you found as module base address
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
darkpoet24
How do I cheat?
![]() Reputation: 0
Joined: 13 Feb 2012
Posts: 2
|
| Posted: Mon Feb 13, 2012 9:10 pm Post subject: |
|
|
| Dark Byte wrote: | Note the text "This pointer points to address 0aa50000"
That means that the address at "MemoryMan.dll"+0002D3CC contains the value 0aa50000, not that "MemoryMan.dll"+0002D3CC IS 0aa500000
To confirm:
In cheat engine go to memoryview, hexview. Rightclick and select goto address
Fill in the address "MemoryMan.dll"
The address should now match the address you found as module base address |
Awwww snap. I'm an idiot, thank you.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
