Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


How to use DBKernel to get module info of a process.

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Source
View previous topic :: View next topic  
Author Message
Alice42069
How do I cheat?
Reputation: 0

Joined: 25 Jan 2025
Posts: 2

PostPosted: Sat Jan 25, 2025 10:12 pm    Post subject: How to use DBKernel to get module info of a process. Reply with quote

Im working on a small project to interface with the DBKernel Driver. I've implemented read/write just fine, now im trying to get the base address of a process. What I could figure out from the source code / online research is that a process contains a list of modules. I looked through the source code for hours and could not figure out how CE communicates with the driver to get a process's module information, I'm wondering how to use the driver to get the module information, do I use `IOCTL_CE_QUERYINFORMATIONPROCESS`? Is there an easy way to get the base address of a process that im missing?
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 467

Joined: 09 May 2003
Posts: 25620
Location: The netherlands

PostPosted: Sun Jan 26, 2025 2:28 am    Post subject: Reply with quote

use the loadedmodulelist in the eprocess structure of the process

abd get the processlist from the activeprocesslist which you can reach from the first process (4) which has a public symbol defined

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Alice42069
How do I cheat?
Reputation: 0

Joined: 25 Jan 2025
Posts: 2

PostPosted: Sun Jan 26, 2025 5:05 pm    Post subject: THanks Reply with quote

Thank you, I used `IOCTL_CE_GETPEPROCESS` to get the address of the eprocess, then read the `PVOID SectionBaseAddress` address field.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Source All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites