Accessing another process's pointers from a trainer

[Jabberwock]

Hi guys it's me again.
I know how to access pointers from a DLL. But from a trainer this is a first to me. In DLL I use the "GetModuleHandle" function to get the client offset, so I'm trying to do the same here, just differently with the use of the "GetModuleHandleEx" function. But I get an error "Couldn't find module", therefore I need your help.

void mainP()
{
	HWND hWnd = FindWindow(NULL, "Alliance of Valiant Arms");

	if (!hWnd)
	{
		MessageBox(NULL, "Couldn't find AVA window.", "Error", MB_OK | MB_ICONERROR);
		return;
	}

	unsigned long pId;
	GetWindowThreadProcessId(hWnd, &pId);
	HANDLE hProc = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION, false, pId);

	if (!hProc)
	{
		MessageBox(NULL, "Couldn't open the process.", "Error", MB_OK | MB_ICONERROR);
		return;
	}

	HMODULE module;

	if (GetModuleHandleEx(0, "AVA.exe", &module) == NULL)
		ShowErr();

	unsigned long dwPointer;
	ReadProcessMemory( hProc, (PVOID)0x01BFC478, &dwPointer, 4, 0 );

	MessageBox(NULL, "point " + (unsigned long)dwPointer, "Error", MB_OK | MB_ICONERROR);

	CloseHandle(hProc);
}

[radnomguywfq3]

The executable image usually has its sections loaded at the base address of 0x400000 99% of the time; i.e you don't need to find the base address, you can just assume that it is 0x400000.

Technically, you need to read ImageBase which will tell you the base address of the image, but by default (and there is no reason to do otherwise) it will aways be 0x400000. DLLs usually take advantage of this to avoid being relocated (which can significantly increase load time.)

The reason GetModuleHandleEx doesn't work is because you aren't in the targets address-space; this API only works on the current address-space (your application.)


You can also use EnumProcessModules as a substitute for GetModuleHandle, which will return a list of handles to all the modules loaded in the target's address space, then you can use GetModuleBaseName to filter the modules by name.

['Bruno]

I guess Jeta explained it well, and since you thanked him I will mark as solved.