Reading pointers

So after I inject my DDL, how can I read a pointer's content? And how can I change it?
By memcpy function or by WriteProcessMemory?

if I have a pointer like this one:
[[01BFC478+45]+74]
How can I change it?

Thanks in advance for all the helpers!

If you're using a dll you don't need the WriteProcessMemory, you can access the pointer directly. In your case it'll be like this.

*(*(*01BFC478)+45)+74) <== it's been a while since I last used C++, so this is probably wrong.. wait for someone with a little more experience ;P

I forgot to mention my pointer type is an unicode string. So any helpers? Ant thank you General Shepherd for trying to help me.

Well, we would have to shoot in the dark since we don't know how many levels down the pointer is because you didn't post disassembly, but just logically from your post i would have to say:

Code:

TCHAR string = *(TCHAR*)(*(DWORD*)(01BFC478+45)+74);

And again, this might not be right since you haven't posted disassembly so we can't exactly tell you for sure.

OK so by looking at this; will you be able to tell me how?

The base pointer is "AVA.exe"+01BFC478

I thought it will be like this:

Code:

TCHAR string = *(TCHAR*)(*(DWORD*)(*(DWORD*)0x01BFC478+0x90)+0x24);

But it doesn't seem to work.

---------- Post added at 06:46 AM ---------- Previous post was at 05:54 AM ----------

I'm just trying to make a message with the pointer's content, and it shows me a blank message.

MessageBox(NULL, (LPCWSTR)*(DWORD*)0x01BFC478, TEXT("ERROR"), MB_OK);

---------- Post added at 07:03 AM ---------- Previous post was at 06:46 AM ----------

Wow never thought pointers will be this difficult to handle.

---------- Post added at 08:01 AM ---------- Previous post was at 07:03 AM ----------

Tried to do:

Code:

MessageBox(NULL, (LPCTSTR)*(TCHAR*)(*(DWORD*)(*(DWORD*)(0x01BFC478) + 0x90) + 0x24), TEXT("ERROR"), MB_OK);

But the game is crashing on me. Why it's doing that?

---------- Post added at 09:37 AM ---------- Previous post was at 08:01 AM ----------

OK tried a different thing:

Code:

	DWORD var;
	VirtualProtect((TCHAR*)(*(DWORD*)(*(DWORD*)(0x01BFC478) + 0x90) + 0x24), 4, PAGE_EXECUTE_READWRITE, (DWORD*)&var);
	*(TCHAR*)(*(DWORD*)(*(DWORD*)(0x01BFC478) + 0x90) + 0x24) = 123;

And still it crashes.

---------- Post added at 09:43 AM ---------- Previous post was at 09:37 AM ----------

OK.

@Eidolon, @master131, @barata55 Any idea?

OK i think I got it right! but a small problem at the end:

Code:

			DWORD value = (DWORD)GetModuleHandle(0);
			value = *(DWORD*)(0x01BFC478 + value);
			value = *(DWORD*)(value + 0x90);
			TCHAR rara = *(TCHAR*)(value + 0x24);
			
			char *buffer = new char[255];
			sprintf(buffer, "%d", rara);
			MessageBoxA(NULL, buffer, "test", MB_OK);

It's showing me the first or 2 bytes. And a number 76. It should show me the player's name which is in unicode.

Try this:

sprintf(buffer, "%d", rara);

Change to:

sprintf(buffer, "%s", rara);

Thanks Barata...

I did that and the game crashed.
And when I change "new char[255]" to "new char[2147483647]" it also crashes.

---------- Post added at 12:38 PM ---------- Previous post was at 12:12 PM ----------

I changed the code to:

Code:

			DWORD value = (DWORD)GetModuleHandle(NULL);
			value = *(DWORD*)(0x01BFC478 + value);
			value = *(DWORD*)(value + 0x90);
			LPWSTR rara = *(LPWSTR*)(value + 0x24);
			
			char *buffer = new char[255];
			sprintf(buffer, "%s", rara);
			MessageBoxA(NULL, buffer, "test", MB_OK);

and I get this:

---------- Post added at 12:47 PM ---------- Previous post was at 12:38 PM ----------

In CE it's checked as "Zero-Terminate string"

Use swprintf which is the version of sprintf which is designed for wide-character strings. You'll also need an array of wchar_t instead of char. It'll be more or less like this.

Code:

wchar_t *buffer = new wchar_t[255];
swprintf(buffer, 255, L"%s", rara);

the second parameter of swprintf is the maximum number of characters to store(the array size)

"cannot convert parameter 2 from 'wchar_t *' to 'LPCSTR'"

And when I attach this type to it I get the same gibberish message.
http://i.imgur.com/ACyhv.png

I guess I need to modify the MessageBoxA function.

Originally Posted by Jabberwock

"cannot convert parameter 2 from 'wchar_t *' to 'LPCSTR'"

And when I attach this type to it I get the same gibberish message.
http://i.imgur.com/ACyhv.png

I guess I need to modify the MessageBoxA function.

Change your project configuration to use multibyte strings. Open the properties, and navigate to Configuration Properties > General. Switch Character Set to "Use Multi-Byte Character Set". That will solve the error... i guess

You're forgetting the "AVA.exe" in "AVA.exe"+0x01BFC478 which is the base address for the AVA.exe module. You can obtain this by using GetModuleHandle. You should explicitly use "AVA.exe" instead of passing NULL.

Also, in Cheat Engine, is it a Unicode string? If not, you should not be using LPWSTR. A char* should work fine if it's ASCII and a null terminated string....

Originally Posted by MarkHC

Change your project configuration to use multibyte strings. Open the properties, and navigate to Configuration Properties > General. Switch Character Set to "Use Multi-Byte Character Set". That will solve the error... i guess

I changed it and it didn't work. It's the same.

In CE it's unicode. Here:

---------- Post added at 01:49 AM ---------- Previous post was at 01:42 AM ----------

When I try to do:

Code:

DWORD value = (DWORD)GetModuleHandle("AVA.exe");
value = *(DWORD*)(0x01BFC478 + value);
value = *(DWORD*)(value + 0x90);
wchar_t rara = *(wchar_t*)(value + 0x24);
MessageBoxW(NULL, (LPWSTR)rara, NULL, MB_OK);

The game crashes.
From my reading, wchar_t is only 2 bytes long. So it isn't compitable. I need 4 bytes solution.

Even when I'm not tryng to show unicode string I can't.

SolvedReading pointers

Similar Threads

Tags for this Thread