[VB.Net] Read Memory

[jabbathehutt]

Hi,
Im really confused right now. I was searching with Cheat Engine for a text and I found it. Now I want to know, how to read the text. It isnt so easy as for Integer. Any ways to do this? I would really happy if someone can help me.

[s00rk]

Maybe this could help you

 'API ReadProcessMemory
   <DllImport("kernel32.dll", SetLastError:=True)> _
     Private Shared Function ReadProcessMemory( _
       ByVal hProcess As IntPtr, _
       ByVal lpBaseAddress As IntPtr, _
       <Out()> ByVal lpBuffer() As Byte, _
       ByVal dwSize As Integer, _
       ByRef lpNumberOfBytesRead As Integer) As Boolean
    End Function

    Private Function FindAddress(ByVal pHandle As IntPtr, ByVal BaseAddress As IntPtr, ByVal StaticPointer As IntPtr, ByVal Offsets() As IntPtr) As IntPtr
        ' Crearemos un buffer de 4 bytes para sistema de32-bit o 8 bytes sobre un sistema de 64-bit .
        Dim tmp(IntPtr.Size - 1) As Byte
        Dim Address As IntPtr = BaseAddress
        ' Checaremos para 32-bit vs 64-bit.
        If IntPtr.Size = 4 Then
            Address = New IntPtr(Address.ToInt32 + StaticPointer.ToInt32)
        Else
            Address = New IntPtr(Address.ToInt64 + StaticPointer.ToInt64)
        End If
        ' Loop de cada Offset hasta encontrar el Address
        For i As Integer = 0 To Offsets.Length - 1
            ReadProcessMemory(pHandle, Address, tmp, IntPtr.Size, 0)
            If IntPtr.Size = 4 Then
                Address = BitConverter.ToInt32(tmp, 0) + Offsets(i).ToInt32()
            Else
                Address = BitConverter.ToInt64(tmp, 0) + Offsets(i).ToInt64()
            End If
        Next
        Return Address
    End Function

    Public Function Obtener_Address()
        Dim p As Process() = Process.GetProcessesByName("Gunz")

        ' Obtendremos el Handle y el BaseAddress de nuestro proceso
        Dim pID As IntPtr = p(0).Handle
        Dim base As IntPtr = p(0).MainModule.BaseAddress
        ' Colocamos Nuestro Pointer Estatico
        Dim sptr As IntPtr = &H26C7C8
        ' Y aqui nuestro Offset segun los necesarios
        Dim offsets() As IntPtr = {&H0, &H1F8, &H8, &H84, &H0}
        Dim addr As IntPtr = FindAddress(pID, base, sptr, offsets)
        Dim f As String
        f = addr.ToString
        Return f
    End Function

Well with this we got the address ^^
And if you donde know how found the pointers look this

Post Original:

This is a simple bit of code to make looking up addresses from pointers really easy.

First you'll need to add the API reference for ReadProcessMemory for this to work. Here it is:

VB.NET

	
	
    <DllImport("kernel32.dll", SetLastError:=True)> _
     Public Shared Function ReadProcessMemory( _
       ByVal hProcess As IntPtr, _
       ByVal lpBaseAddress As IntPtr, _
       <Out()> ByVal lpBuffer() As Byte, _
       ByVal dwSize As Integer, _
       ByRef lpNumberOfBytesRead As Integer) As Boolean
    End Function

C#

	
	
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out()] byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

And this is the code I wrote to look up an address from a pointer and a list of offsets:

VB.NET

	
	
    Private Function FindAddress(ByVal pHandle As IntPtr, ByVal BaseAddress As IntPtr, ByVal StaticPointer As IntPtr, ByVal Offsets() As IntPtr) As IntPtr
        ' Create a buffer that is 4 bytes on a 32-bit system or 8 bytes on a 64-bit system.
        Dim tmp(IntPtr.Size - 1) As Byte
        Dim Address As IntPtr = BaseAddress
        ' We must check for 32-bit vs 64-bit.
        If IntPtr.Size = 4 Then
            Address = New IntPtr(Address.ToInt32 + StaticPointer.ToInt32)
        Else
            Address = New IntPtr(Address.ToInt64 + StaticPointer.ToInt64)
        End If
        ' Loop through each offset to find the address
        For i As Integer = 0 To Offsets.Length - 1
            ReadProcessMemory(pHandle, Address, tmp, IntPtr.Size, 0)
            If IntPtr.Size = 4 Then
                Address = BitConverter.ToInt32(tmp, 0) + Offsets(i).ToInt32()
            Else
                Address = BitConverter.ToInt64(tmp, 0) + Offsets(i).ToInt64()
            End If
        Next
        Return Address
    End Function

C#

	
	
private IntPtr FindAddress(IntPtr pHandle, IntPtr BaseAddress, IntPtr StaticPointer, IntPtr[] Offsets)
{
    // Create a buffer that is 4 bytes on a 32-bit system or 8 bytes on a 64-bit system.
    byte[] tmp = new byte[IntPtr.Size];
    IntPtr Address = BaseAddress;
    // We must check for 32-bit vs 64-bit.
    if (IntPtr.Size == 4) {
        Address = new IntPtr(Address.ToInt32 + StaticPointer.ToInt32);
    }
    else {
        Address = new IntPtr(Address.ToInt64 + StaticPointer.ToInt64);
    }
    // Loop through each offset to find the address
    for (int i = 0; i < Offsets.Length; i++) {
        ReadProcessMemory(pHandle, Address, tmp, IntPtr.Size, 0);
        if (IntPtr.Size == 4) {
            Address = BitConverter.ToInt32(tmp, 0) + Offsets(i).ToInt32();
        }
        else {
            Address = BitConverter.ToInt64(tmp, 0) + Offsets(i).ToInt64();
        }
    }
    return Address;
}



Here's how you use it:
1) Get a hande to the process. I personally use the Process class to find the process I need (Process.GetProcessesByName) and then read from the Handle property.
2) Get the base address of the process, which is usually 0x400000 (&H400000 in VB.NET). You can use Process.MainModule.BaseAddress property to get the address if you want to.
3) Create an array of offsets for each pointer. If CE's pointer scan returns 0x0062B688 + 0xC, 0x38, create an array whose values are 0xC and 0x38. The StaticPointer parameter in this case would be 0x0062B688.

Here's an example:

VB.NET

	
	
' I'm assuming p is a Process object that represents the game process.
Dim pID As IntPtr = p.Handle
Dim base As IntPtr = p.MainModule.BaseAddress
' Our static pointer...
Dim sptr as IntPtr = &H62B688
' And our offsets...
Dim offsets() As IntPtr = {&HC, &H38}
Dim addr As IntPtr = FindAddress(pID, base, sptr, offsets)

C#

	
	
// I'm assuming p is a Process object that represents the game process.
IntPtr pID = p.Handle;
IntPtr @base = p.MainModule.BaseAddress;
// Our static pointer...
IntPtr sptr = 0x62b688;
// And our offsets...
IntPtr[] offsets = { 0xc, 0x38 };
IntPtr addr = FindAddress(pID, @base, sptr, offsets);

And that's it. This method has saved me loads of time when creating trainers.

Creditos: Burningmace

Obtieniendo Pointer y Offsets:

there is an easier way of find pointers but this is another way im doing this cause the game im using doesn't allow you to attach a debugger or it will crash! ok here we go first open up CE
once ce is opened click the little Computer icon

once you click it you will get a list of process id's scroll down untill you see yours sense im doing halo 2 mine will look like this

now click Open once you have your process selected then find your address's for health amo or whatever your looking for i am not showing how to find address's in this tutorial now once you find that addy double click it so it adds it to your bottom column like this

now right click it and choose pointer scan for this address

once you click it make sure the form fields look like mine

now click OK then it will pop up with a form that will ask you for a folder where it will save your files it's good to make new folder name it whatever you want then locate the folder then make a name then click save now CE will now search for pointers this can take awhile depending on how fast your pc is once it is done you will get a window that looks like this

as you can see there are alot! of pointers that we need to get out of the way to find are real pointer you need the address to change again so restart your game or kill your self whatever resets the addy now look for the address again once you find it it should look something like

now go back to your pointerscan window and click [pointer scanner]

once you clikc it you will get a window put the addy from ce into it exactly the same like this

click OK and save the scan same as the first one but put scan 1 at the end
once you do you should get alot less pointers if you dont keep resting the addy and searching untill you get down to a couple pointers like me i have 1 left that means it is it and i found the correct pointer

PS: this isn't really the pointer for my addy if it was it would show 2 as the value i just put it there to speed up my tut

now double click it it will add it to ce once you do save it and that pointer will always point to that address and it will never change

have any questions on cheatengine or programming hacks in vb.net add me on MSN or Xfire
msn=ipivb@live.com
Xfire=codehpro

If this TUT helped you please press the thanks button -->>

Credits:
CodeHPro
.mokk. - s00rk

[jabbathehutt]

I dont need this, I need a funtion to read a text out of memory.

[s00rk]

sorry, hehe well

Imports System
Imports System.Text
Imports System****ntime.InteropServices
Imports System.ComponentModel
Imports System.Windows.Forms.Application

Module ReadMemory
    <DllImport("kernel32.dll", SetLastError:=True)> Private Function ReadProcessMemory _
(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByRef lpBuffer As Byte, _
 ByVal iSize As Integer, ByRef lpNumberOfBytesRead As Integer) As Boolean
    End Function


    Public Sub ReadMemoryP(ByVal address As Integer)
        Try
      
Dim process0 as string = "calc" 'process0 is the name of pocess

            Dim prox As Process() = Process.GetProcessesByName("process0")
            MsgBox(GetTextinMemory(prox(0).Handle, address, 16) & GetTextinMemory(prox(0).Handle, address + 32, 16))
        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
    End Sub


    Private Function GetTextinMemory(ByVal ProcessHandle As IntPtr, ByVal MemoryAddress As IntPtr, ByVal CharsToRead As Integer, Optional ByVal IsUnicode As Boolean = True) As String
        Dim ReturnValue As String = vbNullString
        Dim StringBuffer() As Byte
        If IsUnicode Then
            ReDim StringBuffer(CharsToRead * 2 - 1)
        Else
            ReDim StringBuffer(CharsToRead - 1)
        End If
        Try
            'Dim p As Process() = Process.GetProcessesByName(process0)
            If ReadProcessMemory(ProcessHandle, MemoryAddress, StringBuffer(0), StringBuffer.Length, Nothing) Then
                If IsUnicode Then
                    ReturnValue = System.Text.Encoding.ASCII.GetString(StringBuffer)
                Else
                    ReturnValue = System.Text.Encoding.Default.GetString(StringBuffer)
                End If
            End If

        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
        Return ReturnValue
    End Function
End Module

And now only of the Form or other place put
In Label3.Text put the addres where you want read

ReadMemoryP(Label3.Text)

[jabbathehutt]

Thanks for you help.
Still gives me an error in ReadMemoryP.

[NextGen1]

What's the error?

[jabbathehutt]

It keeps saying that I dont have the rights for this. Any other code?

[freedompeace]

It keeps saying that I dont have the rights for this. Any other code?

1. You need administrator privileges (well your app does)
2. Enter debug mode.

[jabbathehutt]

Sorry that I have to grab the thread again.
This is my mistake:
Error Message: BC30491: Expression does not produce a value.
Dont know what I do wrong -.-
This is my full code:
MsgBox(ReadMemoryP(&H69CCDD0))
Haha
Any 1 can help?

[nonamemonkey]

msgbox expects a return value from ReadMemoryP but ReadMemoryP is a sub so it has no return value.

ReadMemoryP(&H69CCDD0)
should work but i would make ReadMemoryP a function instead of a sub

to do this i would change
Public Sub ReadMemoryP(ByVal address As Integer)
to
Public function ReadMemoryP(ByVal address As Integer) as string
and
End Sub
to
end function
then change
MsgBox(GetTextinMemory(prox(0).Handle, address, 16) & GetTextinMemory(prox(0).Handle, address + 32, 16))
to
return GetTextinMemory(prox(0).Handle, address, 16) & GetTextinMemory(prox(0).Handle, address + 32, 16)
then this
MsgBox(ReadMemoryP(&H69CCDD0))
should work fine.

[NextGen1]

msgbox expects a return value from ReadMemoryP but ReadMemoryP is a sub so it has no return value.

ReadMemoryP(&H69CCDD0)
should work but i would make ReadMemoryP a function instead of a sub

to do this i would change
Public Sub ReadMemoryP(ByVal address As Integer)
to
Public function ReadMemoryP(ByVal address As Integer) as string
and
End Sub
to
end function
then change
MsgBox(GetTextinMemory(prox(0).Handle, address, 16) & GetTextinMemory(prox(0).Handle, address + 32, 16))
to
return GetTextinMemory(prox(0).Handle, address, 16) & GetTextinMemory(prox(0).Handle, address + 32, 16)
then this
MsgBox(ReadMemoryP(&H69CCDD0))
should work fine.

Not going to matter to much.

What I am tying to figure out in all this, is what are you trying to do exactly, and why?

Are you looking to get text from a application?
If so , You can use Marshal and WM_GETTEXT

We use Marshal for allocating unmanaged memory, or converting managed to unmanaged.

We use WM_GETEXT to get text from another application.

Really, I feel things are a little vague. Some more in depth information would help us alot.

(specifics, application, what kind of text, etc)