Cheat Engine

[zeion]

Hi,

After I've successfully injected my dll into my target process, say "target.exe", how do I get the base address of "target.exe"? I used the pointer scan from CE to get the static multi level pointer for a value I want to change, but the first address is "target.exe" + offset + offset .. and I think I need to find the address for "target.exe" which I think should be different each time?

I've tried GetModuleHandle(0) but I'm not sure how to work it?

Thanks

[TsTg]

Since you injected the dll of yours inside the target executable, GetModuleHandle(0) will give you the base address of the 'target.exe'.

Next, you need to add it to the offset address of yours, say base address is 0x400000 and my address is 0x412345, so this equivalent to "target.exe" + 0x12345.

[zeion]

Okay so it seems like my base address for "target.exe" is the same every time I start the game.. is this right? I was expecting it to be different each time otherwise what's the point of having the offsets?

Also it seems that when I read the pointer in CE the address is different each time so I thought that was because "target.exe" has a different address each time. But when I use GetModuleHandle(0) in my DLL and print it it gives the same address. But when I try to calculate it manually from what CE tells me (by subtracting the first offset) I get a different value for "target.exe" each time?

[TsTg]

yeah if the game doesn't use ASLR, the image base should be static, you can also go to cheat engine's memory view window, then go to 'View->Enumerate DLL's and Symbols' and find the target.exe name, the number beside it is the image base.

if you say it changes, can you upload a picture to show me your calculations ?

[zeion]

Hmm it won't let me post urls? I've left out the http in front of the links :/
From this:

img198.imageshack.us/img198/6113/hz8z.png

Would mean that "target.exe" = E189660 - 12D90D4 = CEB058C correct?

Then I restart the game and get this:

img818.imageshack.us/img818/3951/j48e.png

Which would mean that "target.exe" = E13E070 - 12D90D4 = CE64F9C?

Although it is true that when I go to View->Enumerate DLL's and Symbols it does always show 0x40000000, so I am confused.

[atom0s]

You can get the game executables base using Module32First as the processes executable is always the first module listed in the loop. Assuming you have issues with GetModuleHandle( NULL ).

[TsTg]

[zeion]

I got it to work!!!

Thanks so much for your help and explanation, I understand it a little more now