Cheat Engine

[DarkOwnage]

Hey,
I have been reading these forums for a while but now have my own plea for help.

Basically, I am writing a generic program that will allow the user to select a process, add some offsets in a grid, and click a button that will extract the data from that "target address" (after taking the base address and adding the offsets).

In order to test my program, I am comparing my "Value" and Address information against Cheat Engine 6.4.

So, as you would expect when the user clicks the extract button they get a different value then what was returned by cheat engine because it is pointed to an entirely different address!

First attachment shows the pointer setup in Cheat Engine along with how it is setup in my created program. I have also modified my program to output multiple types just in case that was the cause of the value mismatch between Cheat Engine and my own program.

Here is the code that seeks out the "target address" (not the value yet):
****Third Attachment**** (cannot post URL's yet apparently...)

And here is the code that takes the "target address" and reads the memory for the value:
****Second Attachment**** (cannot post URL's yet apparently...)

I hope you guys can point out what exactly is wrong in my code because I am at a loss here .

[DarkOwnage]

Problem fixed.

Basically, I was making an unneeded call to VirtualQueryEx. One of the various source codes that I studied was a memory dumper. I thought the VirutalQueryEx method would scan a memory address and provide information about that address, more specifically the region size of that specific address.

That is not what VirtualQueryEx does at all. It scans the memory region allocated by the process passed in starting from that memory address until it reaches differing attributes in the memory region. That explains why the array being instantiated was insanely huge because the memory region being reported wasn't for just that address. That also explains why it was reading the wrong memory because my calculated address wasn't the same as the VirtualQueryEx base address.

Anyways, I removed the VirtualQueryEx call and obviously removed the structures that go along with it. I changed it to a basic call to ReadProcessMemory only using the calculated target address (base + offsets retrieved). Cleaned up the code (better error handling around ReadProcessMemory call, disposing, etc.).

Now it works!