Cheat Engine :: View topic - Reading pointers in a dll program

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Reading pointers in a dll program

Cheat Engine Forum Index -> General Gamehacking

View previous topic :: View next topic

Author

Message

Macaroni
Newbie cheater

Reputation: 0

Joined: 29 Sep 2014
Posts: 10
Location: Mars

Posted: Sat Oct 04, 2014 8:57 pm Post subject: Reading pointers in a dll program

I'm trying to simply just read the amount of moves made in solitaire. I've traced the base down to Solitaire.exe+XXXXXXXX = YYYYYYY + offset = value.
I know how to read memory with YYYYYYYY + offset, but I don't know how to get YYYYYYYY. So far I have -

Code:

ModuleHandle = (ULONG_PTR)GetModuleHandle(NULL);

MovesBase = GetPointer(ModuleHandle, XXXXXXXX);

int Moves = GetPointer(MovesBase, offset);

right now what CE says YYYYYYYY is, is not what MovesBase is equalling. Clearly adding them isn't what I'm supposed to be doing(at least not the way I'm doing it) so what is? :O
_________________

Hi! I'm new.

Dark Byte
Site Admin

Reputation: 470

Joined: 09 May 2003
Posts: 25784
Location: The netherlands

Posted: Sun Oct 05, 2014 4:53 am Post subject:

Dereference MovesBase+offset to an integer _________________ Do not ask me about online cheats. I don't know any and wont help finding them. Like my help? Join me on Patreon so i can keep helping

Macaroni
Newbie cheater

Reputation: 0

Joined: 29 Sep 2014
Posts: 10
Location: Mars

Posted: Sun Oct 05, 2014 9:19 am Post subject:

Dark Byte wrote:

Dereference MovesBase+offset to an integer

Would this work?

Code:

private: System::Void MainUI_Load(System::Object^ sender, System::EventArgs^ e) {
ModuleHandle = (ULONG_PTR)GetModuleHandle(NULL);

MovesBase = GetPointer(ModuleHandle, XXXXXXXX);

int Moves = GetPointer((int)MovesBase, (int)offset);

}

DWORD GetPointer(LPDWORD lpdwBase, INT iOffset)
{

__try
{
return *(LPDWORD)(*lpdwBase + iOffset);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return NULL;
}
}

Or do I need to dereference it after GetPointer does its job? Something like -

Code:

int Moves = (int)GetPointer(MovesBase, offset);

Sorry If I'm completely misunderstanding you here.

Edit- After reading an article on dereferencing, I now understand that what I have done is not dereferencing, so let me give it another go.

Is this closer?

Code:

int Moves = GetPointer((DWORD*)MovesBase, offset);

_________________

Hi! I'm new.

Dark Byte
Site Admin

Reputation: 470

Joined: 09 May 2003
Posts: 25784
Location: The netherlands

Posted: Sun Oct 05, 2014 10:17 am Post subject:

I have no idea what GetPointer is as it's not an known windows api. anyhow try Moves = (int )(MovesBase+offset); _________________ Do not ask me about online cheats. I don't know any and wont help finding them. Like my help? Join me on Patreon so i can keep helping

Macaroni
Newbie cheater

Reputation: 0

Joined: 29 Sep 2014
Posts: 10
Location: Mars

Posted: Sun Oct 05, 2014 11:06 am Post subject:

Dark Byte wrote:

I have no idea what GetPointer is as it's not an known windows api.

anyhow try
Moves = *(int *)(MovesBase+offset);

GetPointer is

Code:

DWORD GetPointer(LPDWORD lpdwBase, INT iOffset)
{

__try
{
return *(LPDWORD)(*lpdwBase + iOffset);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return NULL;
}
}

I can get moves with a dynamic address + offset, but I can't correctly get the dynamic address using ModuleHandle and XXXXXX. I tried using my getpointer function, which adds them as if they're pointer / offset and then it gave something completely different then Cheat engine. After reading the Getpointer function I use, do you know why I'm having problems here -
MovesBase = GetPointer(ModuleHandle, XXXXXXXX);
_________________

Hi! I'm new.

zm0d
Master Cheater

Reputation: 7

Joined: 06 Nov 2013
Posts: 423

Posted: Sun Oct 05, 2014 11:26 am Post subject:

Code:

void *GetPointerSafest(DWORD PointerBase, ...)
{
DWORD CurrentPointer = (PointerBase + (DWORD)GetModuleHandle(0));
DWORD LastOffset = 0, BytesRead;
va_list Params;
va_start(Params, PointerBase);
for(;;)
{
unsigned int CurrentOffset = va_arg(Params, unsigned int);
if(CurrentOffset != 0xffffffff)
{
CurrentPointer += LastOffset;
ReadProcessMemory((HANDLE)-1, (void*)CurrentPointer, (void*)&CurrentPointer, 4, &BytesRead);
if(BytesRead != 4 || CurrentPointer == 0) //failed reading or we ran into null pointer!
{
CurrentPointer = 0;
break;
}
LastOffset = CurrentOffset;
}
else
{
CurrentPointer += LastOffset;
break;
}
}
va_end(Params);

return (void*)CurrentPointer;
}

use this method from SteveAndrew.
Also works with multi-level pointer.

Macaroni
Newbie cheater

Reputation: 0

Joined: 29 Sep 2014
Posts: 10
Location: Mars

Posted: Sun Oct 05, 2014 12:29 pm Post subject:

zm0d wrote:

Code:

use this method from SteveAndrew.
Also works with multi-level pointer.

Thanks, I'll let you know how it goes once I get home.

Edit - @zm0d
It's not reading the pointer correctly.

MovePointer = (DWORD)GetPointerSafest(XXXXXX);

but MovePointer comes back 0. If I do -

MovePointer = *((DWORD*)GetPointerSafest(XXXXXX));

then when it gets called I get an error saying
object-reference-not-set-to-an-instance-of-an-object

The value in CE is a random address though.

Edit- after some tweaking I got it working, thanks everyone who helped!
_________________

Hi! I'm new.

zm0d
Master Cheater

Reputation: 7

Joined: 06 Nov 2013
Posts: 423

Posted: Thu Oct 09, 2014 6:58 am Post subject:

You`re welcome

Display posts from previous:

	Cheat Engine Forum Index -> General Gamehacking	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum