Cheat Engine

[Shinobi_Mega]

Hello everyone, I use it in my readings with krymemory's autoit script for 64-bit games and I'm successful, but I've reached a point that I'm struggling to resolve.
The address works perfectly with the cheat engine. however, it is based on a ddl within the app.exe

appgame.exe > "GameAssembly.dll" + 02E2D988 and so on.
When it's with appgame.exe + 02E2D988 and so on, it works perfectly.

Has anyone gone through this or is going through this, I found a post here, the person solved it but didn't provide the solution to help us, thanks for the help everyone.

[atom0s]

You can use API from the ToolHelp32 or PSAPI libraries for obtaining the base address to modules.

ToolHelp32:
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

You can find the full reference documentation for the ToolHelp32 library here:
https://learn.microsoft.com/en-us/windows/win32/toolhelp/tool-help-functions

PSAPI:
- EnumProcesses
- EnumProcessModules / EnumProcessModulesEx

You can find the full reference documentation for the PSAPI library here:
https://learn.microsoft.com/en-us/windows/win32/psapi/psapi-functions

[Shinobi_Mega]

I don't know if it's possible to use api with autoit, I haven't seen that yet.
I was testing here and in a conclusion.
via read_Pointer I always get 0
however, via Read_Memory , I receive a wrong value, but it seems that the sum of the offsets is not in agreement, the appgame base address, ok, modulo address ok, the same as the cheat engine, using autoit with the krymemory library, but the sum of offsets is going wrong, with ReadMemory, I saw in a post here a while ago that a user had the same problem, but he said he solved it and didn't post the solution... it's crazy...

[atom0s]

Yes, it is possible. AutoIt exposes an FFI setup via their DllCall function. There are a ton of examples of using the API I gave above around the web with AutoIt.

[Shinobi_Mega]

I didn't understand your help, I looked at the api and it's in c, I don't know how to convert this, but I appreciate your help, moderator. I'll research a little more, this process you gave me I found very complicated to understand, you have to convert it... using dllcall in autoit I even understand it a little, but which API to use is already complicated.

[Shinobi_Mega]

_Module_GetBaseAddress($ahHandle, $sModuleName)

Hi guys, I'm having difficulty using this function in the krymemory library.
_Module_GetBaseAddress($ahHandle, $sModuleName)

It returns the correct value, but when I add it to the readpointer, it doesn't read the value correctly, could anyone explain how to solve this, have you ever experienced this?

$lovehandle =$lovehandle = _Process_Open("appgame.exe")
$Module_GetBaseAddress = _Module_GetBaseAddress($lovehandle, "GameAssembly.dll")

Global $Offset_time_Address = 0x02E2D988 ;
Global $Offset_time[5]
$Offset_time[0] = 0xB8
$Offset_time[1] = 0x10
$Offset_time[2] = 0x98
$Offset_time[3] = 0x20
$Offset_time[4] = 0x68

_Process_ReadMemoryPointer($lovehandle, $getAdd + $Offset_time_Address, $Offset_time, "float")
or
_Process_ReadMemoryPointer($lovehandle, $Module_GetBaseAddress + $Offset_time_Address, $Offset_time, "float")