Cheat Engine

[Videogamer555]

I can use the process's ProcessID with OpenProcess to get a handle. However, I want to know the image base address of that process, in that process's virtual memory space. For example, if program XYZ.exe has its image base (first byte of the EXE file) at address 0x500000 in its virtual memory space, how do I go about discovering that 0x500000 is in fact the address. Going into this problem I won't know that it's 0x500000. I just picked that number for this example. I need a way of doing it.

An ugly, and not-at-all-elegent way would be to use something to find the path of the EXE file on the harddrive that coresponds to the process in question. There are API functions I can use to find the file of a process, once I have a handle to the process. Then I can open the EXE file and parse its header to find its image base address. But I want to avoid that. That seems like a lot of steps for a simple thing.

Is there an API function that DIRECTLY returns the base address of that process's image (in-memory copy of the EXE file), if I feed the process's handle to one of that function's parameters?

[atom0s]

- CreateToolhelp32Snapshot
- Module32First / Module32Next

The first module returned will be the main object of the process.

You can also use PSAPI functions instead.