[VB.Net] Read Memory

 'API ReadProcessMemory
   <DllImport("kernel32.dll", SetLastError:=True)> _
     Private Shared Function ReadProcessMemory( _
       ByVal hProcess As IntPtr, _
       ByVal lpBaseAddress As IntPtr, _
       <Out()> ByVal lpBuffer() As Byte, _
       ByVal dwSize As Integer, _
       ByRef lpNumberOfBytesRead As Integer) As Boolean
    End Function

    Private Function FindAddress(ByVal pHandle As IntPtr, ByVal BaseAddress As IntPtr, ByVal StaticPointer As IntPtr, ByVal Offsets() As IntPtr) As IntPtr
        ' Crearemos un buffer de 4 bytes para sistema de32-bit o 8 bytes sobre un sistema de 64-bit .
        Dim tmp(IntPtr.Size - 1) As Byte
        Dim Address As IntPtr = BaseAddress
        ' Checaremos para 32-bit vs 64-bit.
        If IntPtr.Size = 4 Then
            Address = New IntPtr(Address.ToInt32 + StaticPointer.ToInt32)
        Else
            Address = New IntPtr(Address.ToInt64 + StaticPointer.ToInt64)
        End If
        ' Loop de cada Offset hasta encontrar el Address
        For i As Integer = 0 To Offsets.Length - 1
            ReadProcessMemory(pHandle, Address, tmp, IntPtr.Size, 0)
            If IntPtr.Size = 4 Then
                Address = BitConverter.ToInt32(tmp, 0) + Offsets(i).ToInt32()
            Else
                Address = BitConverter.ToInt64(tmp, 0) + Offsets(i).ToInt64()
            End If
        Next
        Return Address
    End Function

    Public Function Obtener_Address()
        Dim p As Process() = Process.GetProcessesByName("Gunz")

        ' Obtendremos el Handle y el BaseAddress de nuestro proceso
        Dim pID As IntPtr = p(0).Handle
        Dim base As IntPtr = p(0).MainModule.BaseAddress
        ' Colocamos Nuestro Pointer Estatico
        Dim sptr As IntPtr = &H26C7C8
        ' Y aqui nuestro Offset segun los necesarios
        Dim offsets() As IntPtr = {&H0, &H1F8, &H8, &H84, &H0}
        Dim addr As IntPtr = FindAddress(pID, base, sptr, offsets)
        Dim f As String
        f = addr.ToString
        Return f
    End Function

This is a simple bit of code to make looking up addresses from pointers really easy.

First you'll need to add the API reference for ReadProcessMemory for this to work. Here it is:

VB.NET

	
Code:
	
    <DllImport("kernel32.dll", SetLastError:=True)> _
     Public Shared Function ReadProcessMemory( _
       ByVal hProcess As IntPtr, _
       ByVal lpBaseAddress As IntPtr, _
       <Out()> ByVal lpBuffer() As Byte, _
       ByVal dwSize As Integer, _
       ByRef lpNumberOfBytesRead As Integer) As Boolean
    End Function

C#

	
Code:
	
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out()] byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

And this is the code I wrote to look up an address from a pointer and a list of offsets:

VB.NET

	
Code:
	
    Private Function FindAddress(ByVal pHandle As IntPtr, ByVal BaseAddress As IntPtr, ByVal StaticPointer As IntPtr, ByVal Offsets() As IntPtr) As IntPtr
        ' Create a buffer that is 4 bytes on a 32-bit system or 8 bytes on a 64-bit system.
        Dim tmp(IntPtr.Size - 1) As Byte
        Dim Address As IntPtr = BaseAddress
        ' We must check for 32-bit vs 64-bit.
        If IntPtr.Size = 4 Then
            Address = New IntPtr(Address.ToInt32 + StaticPointer.ToInt32)
        Else
            Address = New IntPtr(Address.ToInt64 + StaticPointer.ToInt64)
        End If
        ' Loop through each offset to find the address
        For i As Integer = 0 To Offsets.Length - 1
            ReadProcessMemory(pHandle, Address, tmp, IntPtr.Size, 0)
            If IntPtr.Size = 4 Then
                Address = BitConverter.ToInt32(tmp, 0) + Offsets(i).ToInt32()
            Else
                Address = BitConverter.ToInt64(tmp, 0) + Offsets(i).ToInt64()
            End If
        Next
        Return Address
    End Function

C#

	
Code:
	
private IntPtr FindAddress(IntPtr pHandle, IntPtr BaseAddress, IntPtr StaticPointer, IntPtr[] Offsets)
{
    // Create a buffer that is 4 bytes on a 32-bit system or 8 bytes on a 64-bit system.
    byte[] tmp = new byte[IntPtr.Size];
    IntPtr Address = BaseAddress;
    // We must check for 32-bit vs 64-bit.
    if (IntPtr.Size == 4) {
        Address = new IntPtr(Address.ToInt32 + StaticPointer.ToInt32);
    }
    else {
        Address = new IntPtr(Address.ToInt64 + StaticPointer.ToInt64);
    }
    // Loop through each offset to find the address
    for (int i = 0; i < Offsets.Length; i++) {
        ReadProcessMemory(pHandle, Address, tmp, IntPtr.Size, 0);
        if (IntPtr.Size == 4) {
            Address = BitConverter.ToInt32(tmp, 0) + Offsets(i).ToInt32();
        }
        else {
            Address = BitConverter.ToInt64(tmp, 0) + Offsets(i).ToInt64();
        }
    }
    return Address;
}



Here's how you use it:
1) Get a hande to the process. I personally use the Process class to find the process I need (Process.GetProcessesByName) and then read from the Handle property.
2) Get the base address of the process, which is usually 0x400000 (&H400000 in VB.NET). You can use Process.MainModule.BaseAddress property to get the address if you want to.
3) Create an array of offsets for each pointer. If CE's pointer scan returns 0x0062B688 + 0xC, 0x38, create an array whose values are 0xC and 0x38. The StaticPointer parameter in this case would be 0x0062B688.

Here's an example:

VB.NET

	
Code:
	
' I'm assuming p is a Process object that represents the game process.
Dim pID As IntPtr = p.Handle
Dim base As IntPtr = p.MainModule.BaseAddress
' Our static pointer...
Dim sptr as IntPtr = &H62B688
' And our offsets...
Dim offsets() As IntPtr = {&HC, &H38}
Dim addr As IntPtr = FindAddress(pID, base, sptr, offsets)

C#

	
Code:
	
// I'm assuming p is a Process object that represents the game process.
IntPtr pID = p.Handle;
IntPtr @base = p.MainModule.BaseAddress;
// Our static pointer...
IntPtr sptr = 0x62b688;
// And our offsets...
IntPtr[] offsets = { 0xc, 0x38 };
IntPtr addr = FindAddress(pID, @base, sptr, offsets);

And that's it. This method has saved me loads of time when creating trainers.