Cheat Engine

[@pointer]

Hi EveryOne ,


Q1:how can Get the Exe base address?(without using cheat engine)

Q2:is it static or dynamic(lpBaseAddress)?

Q3:how can calculate the Exe base address and add the offsets, to reach to my pointer value?

[atom0s]

You can use API to get the base address, or wrappers depending on what language you are using.
If you need to use direct API calls, you can use either:

Toolhlp32:
- CreateToolhelp32Snapshot
- Process32First
- Process32Next
- Module32First
- Module32Next

PSAPI:
- EnumProcesses
- EnumProcessModules / EnumProcessModulesEx

You can also walk the module list manually via the PEB if you understand how to obtain that information and walk it manually etc.

If you are using a language such as VB.NET or C#, you can use the Process class instead which is a wrapper around various API which will give you all this information already:
http://msdn.microsoft.com/en-us/library/system.diagnostics.process(v=vs.110).aspx

[@pointer]

Sorry for my late reply atom0s


but why i need ;
- EnumProcessModules / EnumProcessModulesEx


HANDLE hProc = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ, FALSE, /*NOTEPAD_PID*/);
DWORD lpBaseAddress = 0x????????; /// i need to get it programmatically
int lpBuffer;
BOOL ReadRam = ReadProcessMemory(hProc, (LPVOID*)lpBaseAddress, &lpBuffer, sizeof(lpBuffer), NULL);
if (ReadRam){
printf(("%d\n"), lpBuffer);
}

Sorry, i am a beginner with C++;
thank You atom0s

[atom0s]

You can see Microsofts examples here on the MSDN.

This is an example of iterating the module list of a process with the CreateToolhelp32Snapshot and similar API:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms686849(v=vs.85).aspx

This is an example of iterating the module list of a process with the PSAPI API:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms682621(v=vs.85).aspx

Keep in mind if you need the base address of the process itself, it will be the first module returned from either of these API.

[STN]

[@pointer]

ok, thanks atom0s , STN
i need to review some lessons in c++
return thanks;