[_Wozniak_]

The first thing I tried was:
http://www.unknowncheats.me/forum/c-and-...nters.html

Using the FindPointer func from that post, and getting the base_address using:

PHP Code


<?php 
DWORD GetProcessBaseAddress(DWORD pidtest)
{
    MODULEENTRY32 me32 = { sizeof(MODULEENTRY32) };
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pidtest);

    if (hSnapshot == INVALID_HANDLE_VALUE)
        return 0;

    if (Module32First(hSnapshot, &me32))
    {
        CloseHandle(hSnapshot);
        return (DWORD)me32.modBaseAddr;
    }

    CloseHandle(hSnapshot);
    return 0;
} 


This all seems really complicated, and I cant even say where its going wrong.
I have tried this before, and I didnt have this much trouble, sadly I lost my old project files.

CE picture:
http://prntscr.com/7emvdv

How can I get the base address of an external process (one I am not injected into) or easily read pointers from a process?
I'm creating a class, so I need the most versatile way, one that can be put into a function and supply arguments.

Anyone have any... pointers for me :P

[StephenRoos]

How can I get the base address of an external process (one I am not injected into)

Call NtQueryInformationProcess on the target process, pass 0 (ProcessBasicInformation member of PROCESSINFOCLASS enum) as the second parameter.

This will get you a struct which, in one of its fields, contains the absolute address of the PEB of the remote process.

Use ReadProcessMemory/NtReadVirtualMemory to copy the PEB from the memory of the remote process to the memory of your process.

You now have a copy of the target process' PEB, the PEB contains a field called ImageBaseAddress. The rest should follow.

[RISC]

The base address of the external process would be the base address of the main module within the process.

I'm not completely understanding your question.
If you want to read from an external process, you'd have to know it's address.
Then you'd use ReadProcessMemory.

A multi level pointer works like this.
You'd call ReadProcessMemory on the highest level pointer.
Add your offset to the pointer read from the address.
Call ReadProcessMemory again on your next pointer.
Add your offset to the pointer from the address.
Call ReadProcessMemory again on your next pointer.

And you continue this until you get down to the base pointer.

A base address isn't the same as a base pointer. The base address could refer to the base of your module. The base pointer could refer to the first function that accesses the pointer. If the pointer is in the .data section, the function will always have the address. If the pointer is allocated dynamically, then you'd use code caving to pull the pointer to the allocated memory from a register.

[_Wozniak_]

Call NtQueryInformationProcess on the target process, pass 0 (ProcessBasicInformation member of PROCESSINFOCLASS enum) as the second parameter.

This is what i think I need.
I will try to do as you say and see if it works.
You wouldnt happen to have any examples right? (And is NtQueryInformationProcess good to use, MSDN mentions its future is not assured)

Edit: You wouldnt have any other way would you? I just don't think that may be the best way. (It seems like a lot of code, isnt it possible to do this in CE?)

[Sylex]

This is what i think I need.
I will try to do as you say and see if it works.
You wouldnt happen to have any examples right? (And is NtQueryInformationProcess good to use, MSDN mentions its future is not assured)

Edit: You wouldnt have any other way would you? I just don't think that may be the best way. (It seems like a lot of code, isnt it possible to do this in CE?)

Microsoft doesn't like people touching low level APIs because they know how effective it makes malware, so they try to keep it as unknown as possible to anyone who isn't employed by them or their partner companies who need it to make drivers, and leave out a lot of documentation. The thing is, a lot of legit windows programs use NtQueryInformationProcess and APIs like it, so if Microsoft wanted to change how it works or remove it, it would make a whole lot of software stop working which means they would lose business. So, as long as windows is based on NT (which it looks like it will be for the foreseeable future) it will be safe to use most ntdll APIs.

There is no better way to do what you are asking, because any other way would still ultimately have to use NtQueryInformationProcess or similar functions. A different way to do it, which isn't really better, would be to call VirtualQueryEx/NtQueryVirtualMemory and find all the base address's of memory, and then scan them for PE files loaded into memory until you find the one you are looking for.

[NTTITONV202]

I'd rather communicate with ntmapviewofsection (most ipcs work this way) and retrieve the peb using the fs register

[_Wozniak_]

ALRIGHT :D
Good news everyone. (I feel like professor farnsworth)
I have got the part from "tutorial-i386.exe"+offset.
But when I tried doing the rest of the offsets I get something weird.

My code (basically):

PHP Code


<?php 
DWORD base = getModuleBaseAddr(game->PROCESSID, _TEXT("Tutorial-i386.exe"));
base = base + 0x00245300; // from CE

byte offsets[] = { 0x754, 0x24c, 0x104, 0x8, 0x6c0 }; // I tried flipping these to the order in CE, but Im pretty sure they are supposed to be in reverse from bottom to top.
base = game->Read((LPCVOID)base);
cout << base << endl; // correct :D! 


Then I tried something along:

PHP Code


<?php 
    DWORD FINAL = 0;
    for (int i = 0; i < 5; i++){
        FINAL= base + offsets[i];
        base = game->Read((LPCVOID)base);
    } 


But final is not correct.

Also tried:

PHP Code


<?php 
    for (int i = 0; i < 5; i++){
        base= base + offsets[i];
        base = game->Read((LPCVOID)base);
    } 


---

Side-note: Thanks to everyone who gave me advice on the previous stuff. Its super helpful :D

[Only3]

what u trying to do with ur loop u can use ReadProcessMemory

[_Wozniak_]

what u trying to do with ur loop u can use ReadProcessMemory

I am using RPM.
thats what game->Read is.

Memory *game = new Memory(optionalProcID);

I was making my own class for memory editing, which is the only reason I even need any of this, so people can develop trainers for games, without having to enter the new address each time.
:D

[Only3]

is the offsets are from the base address
Edit - try it with the code in the first link

[_Wozniak_]

is the offsets are from the base address
Edit - try it with the code in the first link

Ah it worked :D
Thanks Only!

And of course everyone from above!