Posted: Wed Nov 21, 2012 6:25 am Post subject: How does CE reference pointers? Why does it need exe+ptr?
I found a static pointer thanks to CE. For me, that address is 0152EBEC, but by itself it points to 5E1E5516. However, when CE references it like "program.exe"+0152EBEC it finds the correct address.
So what is the difference between "program.exe"+0152EBEC and just 0152EBEC?
I am coding a program that will read the value from whatever the multilevel pointer points to, but address 0152EBEC is not valid for me. And yes, I am reading the process' s memory correctly via ReadProcessMemory.
So I need to do the equivalent of what CE does with "program.exe"+0152EBEC
Joined: 09 May 2003 Posts: 25987 Location: The netherlands
Posted: Wed Nov 21, 2012 7:05 am Post subject:
Program.exe in the notation gets replaced by the address that module is loaded in memory.
So let's say that program.exe is loaded at 00400000 then "program.exe"+0152EBEC gets changed to 00400000+0152ebec=0192ebec
To get the address program.exe is loaded at you can use toolhelp32 api like Module32First/next, or one of the psapi functions _________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum