SolvedReading Memory Help?

Posts 14 of 4 · Page 1 of 1
Reading Memory Help?
Can anyone tell me what's wrong with the following code please? I think my problem is my offsets/base address. Thanks!



Code:
        public static int GetValue(string processName)
        {
            Process process = Process.GetProcessesByName(processName)[0];

            var baseAddress = new IntPtr(process.MainModule.BaseAddress.ToInt32() + 0x0119502C);
            var offsetList = new int[] { 0x44, 0x28 };
            var buffer = new byte[4];
            var lpOutStorage = IntPtr.Zero;

            Memory.ReadProcessMemory(process.Handle, baseAddress, buffer, (uint)buffer.Length, ref lpOutStorage);

            for (int x = 0; x < offsetList.Length - 1; x++)
            {
                baseAddress = IntPtr.Add(baseAddress, offsetList[x]);
                Memory.ReadProcessMemory(process.Handle, baseAddress, buffer, (uint)buffer.Length, ref lpOutStorage);
            }

            var valueBuffer = new byte[255];
            baseAddress = IntPtr.Add(baseAddress, offsetList[offsetList.Length - 1]);
            Memory.ReadProcessMemory(process.Handle, baseAddress, valueBuffer, (uint)valueBuffer.Length, ref lpOutStorage);

            return BitConverter.ToInt32(valueBuffer, 0);
        }
Code:
    public static class Memory
    {
        // constants information can be found in <winnt.h> 
        [Flags]
        public enum ProcessAccessFlags : uint
        {
            All = 0x001F0FFF,
            Terminate = 0x00000001,
            CreateThread = 0x00000002,
            VMOperation = 0x00000008,
            VMRead = 0x00000010,
            VMWrite = 0x00000020,
            DupHandle = 0x00000040,
            SetInformation = 0x00000200,
            QueryInformation = 0x00000400,
            Synchronize = 0x00100000
        }

        [DllImport("kernel32.dll")]
        private static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, uint dwSize, ref IntPtr lpNumberOfBytesRead);

        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(IntPtr hProcess);
    }
Just some small fixes:

RPM:

Code:
        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool ReadProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            [Out] byte[] lpBuffer,
            int dwSize,
            out IntPtr lpNumberOfBytesRead); // You put int lpNumberOfBytesRead
WPM:
Code:
        [DllImport("kernel32.dll")]
        public static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            byte[] lpBuffer,
            int dwSize,
            out IntPtr lpNumberOfBytesWritten); // you put ref IntPtr lpNumberOfBytesWritten
OpenProcess:
Code:
        public enum ProcessAccessFlags : uint
        {
            All = 0x001F0FFF,
            Terminate = 0x00000001,
            CreateThread = 0x00000002,
            VirtualMemoryOperation = 0x00000008,
            VirtualMemoryRead = 0x00000010,
            VirtualMemoryWrite = 0x00000020,
            DuplicateHandle = 0x00000040,
            CreateProcess = 0x000000080,
            SetQuota = 0x00000100,
            SetInformation = 0x00000200,
            QueryInformation = 0x00000400,
            QueryLimitedInformation = 0x00001000,
            Synchronize = 0x00100000
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(
             ProcessAccessFlags processAccess,
             bool bInheritHandle, // No need to marshal it as unmanagedtype bool.
             int processId
        );
Quote Originally Posted by Yemiez View Post
Just some small fixes:

RPM:

Code:
        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool ReadProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            [Out] byte[] lpBuffer,
            int dwSize,
            out IntPtr lpNumberOfBytesRead); // You put int lpNumberOfBytesRead
WPM:
Code:
        [DllImport("kernel32.dll")]
        public static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            byte[] lpBuffer,
            int dwSize,
            out IntPtr lpNumberOfBytesWritten); // you put ref IntPtr lpNumberOfBytesWritten
OpenProcess:
Code:
        public enum ProcessAccessFlags : uint
        {
            All = 0x001F0FFF,
            Terminate = 0x00000001,
            CreateThread = 0x00000002,
            VirtualMemoryOperation = 0x00000008,
            VirtualMemoryRead = 0x00000010,
            VirtualMemoryWrite = 0x00000020,
            DuplicateHandle = 0x00000040,
            CreateProcess = 0x000000080,
            SetQuota = 0x00000100,
            SetInformation = 0x00000200,
            QueryInformation = 0x00000400,
            QueryLimitedInformation = 0x00001000,
            Synchronize = 0x00100000
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(
             ProcessAccessFlags processAccess,
             bool bInheritHandle, // No need to marshal it as unmanagedtype bool.
             int processId
        );
Thanks! I also fixed the problem by changing the following lines of code:
Code:
private int[] _goldOffsets = { 0x44, 0x28 }; -> private int[] _goldOffsets = { 0x28, 0x44 };
baseAddress = IntPtr.Add(baseAddress, offsetList[x]); -> baseAddressPtr = (IntPtr)BitConverter.ToInt32(buffer, 0) + offsetList[x];
baseAddress = IntPtr.Add(baseAddress, offsetList[offsetList.Length - 1]); -> baseAddressPtr = (IntPtr)BitConverter.ToInt32(buffer, 0) + offsetList[offsetList.Length - 1];
Quote Originally Posted by unSatisfied View Post
Thanks! I also fixed the problem by changing the following lines of code:
Code:
private int[] _goldOffsets = { 0x44, 0x28 }; -> private int[] _goldOffsets = { 0x28, 0x44 };
baseAddress = IntPtr.Add(baseAddress, offsetList[x]); -> baseAddressPtr = (IntPtr)BitConverter.ToInt32(buffer, 0) + offsetList[x];
baseAddress = IntPtr.Add(baseAddress, offsetList[offsetList.Length - 1]); -> baseAddressPtr = (IntPtr)BitConverter.ToInt32(buffer, 0) + offsetList[offsetList.Length - 1];
Good job for figuring it out!

Closed!
Posts 14 of 4 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Need help?