[Solved] Get ModulBase Address

Get ModulBase Address

Hello,
i've a problem by getting an certain baseaddress from hl2.exe.
I'm searching for the BaseAddress in "client.dll" an tried following code:

Code:

Imports System.Runtime.InteropServices
Public Class Form1
  
    Public SpielName As String = "hl2" 'GAME NAME
    Public ModuleName As String = "client.dll"
    Public Prozess As Process
    Public ModuleBase As Integer          

    Sub ProzessName(ByRef Prozess As Process, ByRef ModuleBase As String)

        Dim BaseAdresse As String
        Dim BaseAdresseHex As Integer

        Try
            Dim p As Process = Process.GetProcessesByName(SpielName)(0)
            For Each Module1 As System.Diagnostics.ProcessModule In p.Modules
                If Module1.FileName.IndexOf(ModuleName) <> -1 Then
                    BaseAdresse = Module1.BaseAddress.ToString
                    Prozess = p
                End If
            Next
            Label1.Text = "Module: OK"
        Catch ex As Exception
            Label1.Text = "Module: ERROR"
        End Try

        BaseAdresseHex = BaseAdresse
        ModuleBase = Convert.ToString(BaseAdresseHex, 16)
    End Sub

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        ProzessName(Prozess, ModuleName)

    End Sub
End Class

But this returns simply "nothing" to me.
Is the problem my x64 OS or how can i fix this?

Thanks!

Code:

            For Each Module1 As System.Diagnostics.ProcessModule In p.Modules
                If Module1.ModuleName.Equals(ModuleName) Then
                    BaseAdresse = Module1.BaseAddress.ToString
                    Prozess = p
                End If
            Next

I wonder why people manage to use this kind of stuff but fail to do a comparation...

Fixed (The if comparation, didnt even look at the rest)

Originally Posted by 'Bruno

Code:

            For Each Module1 As System.Diagnostics.ProcessModule In p.Modules
                If Module1.ModuleName.Equals(ModuleName) Then
                    BaseAdresse = Module1.BaseAddress.ToString
                    Prozess = p
                End If
            Next

I wonder why people manage to use this kind of stuff but fail to do a comparation...

Fixed (The if comparation, didnt even look at the rest)

Won't make a difference. If the .Equals is true, .IndexOf will return 0, which is <> -1, so both versions will return true in the correct case.

There may be an issue with the target architecture, and this is why people really need to learn to debug. Remove the Try/Catch block and see if there's an exception. Also, cleaned up the code a bit:

Code:

    Private Shared Function GetModuleBase(ByVal processName As String, ByVal moduleName As String) As IntPtr
        Try
            Dim running As Process() = Process.GetProcessesByName(processName)
            If running.Length > 0 Then
                Dim target As Process = running(0)
                Dim targetModule As ProcessModule = (From pm In target.Modules Where pm.ModuleName.ToLower().Equals(moduleName.ToLower()) Select pm).FirstOrDefault()
                If targetModule IsNot Nothing Then
                    Return targetModule.BaseAddress
                End If
            Else
                Throw New ArgumentOutOfRangeException("Target process is not running")
            End If
        Catch ex As Exception
            MessageBox.Show(String.Format("Post the following error in your thread on MPGH:{0}{0}{1}", Environment.NewLine, ex.Message))
        End Try

        Return IntPtr.Zero
    End Function

To use:

Code:

Dim proc As String = "hl2"
Dim modName As String = "client.dll"
Dim baseAddress As IntPtr = GetModuleBase(proc, modName)
MessageBox.Show(String.Format("{0}'s base address is: 0x{1}", modName, baseAddress.ToString("X8")))

Try the code, tell me if it throws an exception. It may throw something that says like "x64 processes cannot query the modules of x86 processes" or something like that if the architecture is really the issue.

Thanks, but know it returns 0 (like it happens if a readingerror occurrs).

Jesus LINQ... please dont ._.

In the other hand didnt even bother to check its if condition, just looked wierd to me, and tbh its a gay condition D:

Originally Posted by hoschi111

Thanks, but know it returns 0 (like it happens if a readingerror occurrs).

Are you sure the module exists?
EDIT: Nvm it should

Originally Posted by 'Bruno

Jesus LINQ... please dont ._.

Sorry for writing neat code :3

@OP, did you test with the code I provided? If it returns 0 and no messagebox pops up saying there was an error, the module doesn't exist.

Originally Posted by 'Bruno

Jesus LINQ... please dont ._.

In the other hand didnt even bother to check its if condition, just looked wierd to me, and tbh its a gay condition D:

LINQ is super sexy. What's wrong with it ?

Originally Posted by Hassan

LINQ is super sexy. What's wrong with it ?

Note that this isn't related to the topic.
Use the VM|PM function when it comes to such.

Thanks for understanding and I hope you will think about using those functions.
So we can keep the threads clean from personal opinions when there is a question that is to be answered.

And no, I don't mean just you Hassan

Originally Posted by Jorndel

Note that this isn't related to the topic.
Use the VM|PM function when it comes to such.

Thanks for understanding and I hope you will think about using those functions.
So we can keep the threads clean from personal opinions when there is a question that is to be answered.

And no, I don't mean just you Hassan

IT IS related to the thread. Its code used in the thread and its still programming/vb related.
This is the programming section and if you start cleaning/deleting all kind of discussion this will die pretty quick.

This is of course my opinion, and tbh the opinion of most of minions/gmods that have been here in the past

@ LINQ, I feel like you are doing queries, specially like you are coding gay english shit (just like VB).
Personally I dont like it, and a code without it, still is neat and well coded imo.

Originally Posted by Jorndel

Note that this isn't related to the topic.
Use the VM|PM function when it comes to such.

Thanks for understanding and I hope you will think about using those functions.
So we can keep the threads clean from personal opinions when there is a question that is to be answered.

And no, I don't mean just you Hassan

It is related to discussion, and even some off topic can't hurt. Only personal stuff should be on VM/PM.

Having said that, attacking a member is not permitted. Two retards be banned after being banned/infracted many times before about it.

Thanks [MPGH]Jason,
there is no error, but this:

Client.dll exists in hl2.exe! I really don't get it.
(client.dll's base address is: 0x000000)
But it is (in CE) around 54697000 (at the moment, changes every startup)

Originally Posted by hoschi111

Thanks [MPGH]Jason,
there is no error, but this:

Client.dll exists in hl2.exe! I really don't get it.
(client.dll's base address is: 0x000000)
But it is (in CE) around 54697000 (at the moment, changes every startup)

That looks more like he is not finding the module, ill install hl2 and give it a look. But I do know indeed that hl2 should have client.dll.

The client address i want to get, is for Counter Strike Source.
But, every Source Engine Game works like the other. (DOD:S, CS:S, HL2...)
I'm sure there is a client.dll. CE says so too.
client.dll+737A60
client.dll changes every startup.
737A60 is static.

Originally Posted by hoschi111

The client address i want to get, is for Counter Strike Source.
But, every Source Engine Game works like the other. (DOD:S, CS:S, HL2...)
I'm sure there is a client.dll. CE says so too.
client.dll+737A60
client.dll changes every startup.
737A60 is static.

Did run this code on my machine right now with fresh installation of HL2 from STEAM (Ignore the ugly button name, just quick testing)

Code:

     Private Shared Function GetModuleBase(ByVal processName As String, ByVal moduleName As String) As IntPtr
        Try
            Dim running As Process() = Process.GetProcessesByName(processName)
            If running.Length > 0 Then
                Dim target As Process = running(0)
                Dim targetModule As ProcessModule = (From pm In target.Modules Where pm.ModuleName.ToLower().Equals(moduleName.ToLower()) Select pm).FirstOrDefault()
                If targetModule IsNot Nothing Then
                    Return targetModule.BaseAddress
                End If
            Else
                Throw New ArgumentOutOfRangeException("Target process is not running")
            End If
        Catch ex As Exception
            MessageBox.Show(String.Format("Post the following error in your thread on MPGH:{0}{0}{1}", Environment.NewLine, ex.Message))
        End Try

        Return IntPtr.Zero
    End Function

    Private Sub Button1_Click_1(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click

        MessageBox.Show(GetModuleBase("hl2", "client.dll"))

    End Sub

And this worked just fine, got the address returned correctly. May we see your full code?

Originally Posted by 'Bruno

And this worked just fine, got the address returned correctly. May we see your full code?

For now, that is all my code i have. When it starts working i will merge it with my other project for writing some values.
It returns still "Zero".

Some OS/PC/Game details:
Windows 7 64 Bit
Visual Basic 2008
hl2.exe (Counter Strike: Source (steamversion, windowed mode))
Runnig as admin shows no different

I don't know what went wrong, my only explanation is my 64Bit System?

SolvedGet ModulBase Address

Similar Threads

Tags for this Thread