Cheat Engine

rooski · Posted: Sat Feb 13, 2010 1:28 am Post subject: getModuleHandle()

is there a similar function but for a standalone .exe (or any other that will return the base address ), as far as i know i can only use this function if im injecting a DLL .

thanks.

Dark Byte · Posted: Sat Feb 13, 2010 2:29 am Post subject:

look up the apis : createtoolhelp32snapshot , module32first and module32next

or EnumProcessModules(Ex) combined with GetModuleFileNameEx

Jani · Posted: Sat Feb 13, 2010 4:55 am Post subject: Re: getModuleHandle()

rooski · Posted: Sat Feb 13, 2010 1:33 pm Post subject:

@jani

i still dont understand how that will help me , im trying to write a trainer that uses read/write process memory , so my app is in no way hooking / creating a thread in the target process.

all i need is the base address , there has to be a simpler way to get it Sad

thanks for helping out a newbie Smile

.

smartz993 · Posted: Sat Feb 13, 2010 1:56 pm Post subject:

igoticecream · Posted: Sat Feb 13, 2010 4:01 pm Post subject:

well, if your desire is use Read/WriteProcessMemory, you need the process handle, this can be found calling OpenProcess and of course you need the process ID, that can be found by window name (GetWindowThreadProcessId) or by process name (CreateToolhelp32Snapshot)

So:

CreateToolhelp32Snapshot/GetWindowThreadProcessId -> OpenProcess -> Read/WriteProcessMemory

hope this will be useful for you

rooski · Posted: Sun Feb 14, 2010 2:15 am Post subject:

ok so far with this code

Dark Byte · Posted: Sun Feb 14, 2010 4:35 am Post subject:

why isn't it what you are hoping for ?
base address looks exactly like the thing you want

Anden100 · Posted: Sun Feb 14, 2010 4:41 am Post subject:

Dark Byte · Posted: Sun Feb 14, 2010 5:02 am Post subject:

not really, you can make the entry point almost any value you want, as long as it ends with 4 0's
also, it could be the console buffer is full and the first entries have been deleted (so won't even show when scrolling up)

Anden100 · Posted: Sun Feb 14, 2010 5:35 am Post subject:

Jani · Posted: Sun Feb 14, 2010 10:41 am Post subject:

rooski · Posted: Sun Feb 14, 2010 1:39 pm Post subject:

this is kind of newbish of me , but how do i get a usable hex address from that dword one?

and how do i know which module is wow.exe since .szModule is supposed to give me the name but doesnt?

Dark Byte · Posted: Sun Feb 14, 2010 1:52 pm Post subject:

a dword is a hex, it's just a way of displaying it on the screen, you don't need to convert it

szModule is an array (char array)
arrays are usually pointers, so look at the memory that array points to (or just use one of the string routines to make it easier.)

rooski · Posted: Sun Feb 14, 2010 2:16 pm Post subject:

alright , that makes sense , and thank you all so much for the help.

EDIT_________________
for some reason when ever i run my program the process id and base address for the modules change , and what string routines can i use to get the name of the modules?

edit2________
printf() instead of cout , and i had to enable debug privileges to get it working .