Is this Module Pointer function alright?

Since my tool gives me 0 for the client.dll i was wondering if its alright.

Code:

DWORD ModulePointer(char* ModuleName)
	{
		MODULEENTRY32 lpModuleEntry;
		HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID);
		if (!hSnapShot)
			return NULL;
		lpModuleEntry.dwSize = sizeof(lpModuleEntry);
		BOOL __RunModule = Module32First(hSnapShot, &lpModuleEntry);

		char* szModule;
		szModule = (char*)lpModuleEntry.szModule;

		while (__RunModule)
		{
			if (!strcmp(szModule, ModuleName))
			{
				CloseHandle(hSnapShot);
				return (DWORD)lpModuleEntry.modBaseAddr;
			}
			__RunModule = Module32Next(hSnapShot, &lpModuleEntry);
		}
		CloseHandle(hSnapShot);
		return NULL;
	}

Open your file as administrator, some computers mess up with the UAC.

ill try that, thank you

Originally Posted by derkrasseboy

ill try that, thank you

Let me know if it fixes the issue you're facing so I can close your thread as such.

im going to post my result in about 4-5 hours.

------

EDIT: Im pretty sure its a problem in the function. Admin didnt change anything

p&c

Code:

DWORD CMemory::Module(char* szModuleName)
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof(mEntry);

	do
	{
		if (!strcmp(mEntry.szModule, szModuleName))
		{
			CloseHandle(hModule);
			return (DWORD)mEntry.modBaseAddr;
		}
	} while (Module32Next(hModule, &mEntry));

	return false;
}

Originally Posted by Graaff

p&c

Code:

DWORD CMemory::Module(char* szModuleName)
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof(mEntry);

	do
	{
		if (!strcmp(mEntry.szModule, szModuleName))
		{
			CloseHandle(hModule);
			return (DWORD)mEntry.modBaseAddr;
		}
	} while (Module32Next(hModule, &mEntry));

	return false;
}

You aren't calling Module32First.

@OP How are you getting your ProcessID?
Also, did you do any debugging on your part? If so, what did you find?

Originally Posted by WasserEsser

You aren't calling Module32First.

@OP How are you getting your ProcessID?
Also, did you do any debugging on your part? If so, what did you find?

Therefore this works.

Originally Posted by Graaff

Therefore this works.

Module32First doesn't break the function. It's actually needed if you want to make it properly. What if the first module is the desired module? You won't ever find it.

In fact, your code looks like its copied off of a bad example. Why are you using a do while loop if you aren't calling Module32First? The first iteration is utterly useless since the MODULEENTRY32 struct isn't even initializes with any values.

A while loop is what you should be using instead if ( for whatever reason ) you're not calling Module32First.

Originally Posted by Graaff

Code:

DWORD CMemory::Module(char* szModuleName)
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof(mEntry);
	
	bool bFirstRun = true;
	
	do
	{
		// Sorry for this retarded fix.
		if(bFirstRun)
		{
			bFirstRun = false;
			Module32First(hModule, &mEntry);
			
			if (!strcmp(mEntry.szModule, szModuleName))
			{
				CloseHandle(hModule);
				return (DWORD)mEntry.modBaseAddr;
			}
		}
		
		else if (!strcmp(mEntry.szModule, szModuleName))
		{
			CloseHandle(hModule);
			return (DWORD)mEntry.modBaseAddr;
		}
	} while (Module32Next(hModule, &mEntry));

	return false;
}

I've rewritten it a bit so it's a little smaller and hopefully easier to read.

Code:

DWORD CMemory::Module( char* szModuleName )
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof( MODULEENTRY32 );
  
	if ( Module32First( hModule, &mEntry ) )
	{
		bool bModuleFound = false;

		do 
		{
			if (!strcmp( mEntry.szModule, szModuleName ) && bModuleFound = true ) 
				break;
		} while ( Module32Next( hModule, &mEntry ) );
	}

	CloseHandle( hModule );
	return bModuleFound ? reinterpret_cast< DWORD >( mEntry.modBaseAddr ) : 0; 
}

To optimize speed, you could iterate the modulelist once and cache values in a std::vector and traverse the vector later on if you want to gather information about a specific module.

Originally Posted by WasserEsser

~snip~

Are you sure you need to assign "true" here?

Code:

if (!strcmp( mEntry.szModule, szModuleName ) && bModuleFound = true ) break;

Originally Posted by Graaff

Are you sure you need to assign "true" here?

Code:

if (!strcmp( mEntry.szModule, szModuleName ) && bModuleFound = true ) break;

Instead of having a CloseHandle call and a return statement within the while loop AND at the end in case the module wasn't found, i return once at the end based on whether i found the module or not. To determine if i found the module or not, i used the variable bModuleFound, which is false initially. If you assign a variable inside an if statement, the if statement will evaluate to whatever the variable is assigned to after the assignment. Instead of having two lines, one for the if statement and one for assigning the variable, you can do it within the if statement. This way i know if i found the module or not and can either return the modules base address or 0.

Instead of having it written out like this

Code:

if (!strcmp( mEntry.szModule, szModuleName ) )
{
	bModuleFound = true;
	break;
}

you could just do it within the if statement, knowing that it will always evaluate to true if the module was found.

This is how i get my PID and it seems to work out quite well

Code:

      if (!WindowCSGO) { WindowCSGO = FindWindow(NULL, L"Counter-Strike: Global Offensive");}
		if (!ProcessID) { GetWindowThreadProcessId(WindowCSGO, &ProcessID);}

Originally Posted by derkrasseboy

This is how i get my PID and it seems to work out quite well

Code:

      if (!WindowCSGO) { WindowCSGO = FindWindow(NULL, L"Counter-Strike: Global Offensive");}
		if (!ProcessID) { GetWindowThreadProcessId(WindowCSGO, &ProcessID);}

Did you debug your code? If so, what did you find? I don't see anything which could cause the function to return 0. Also, where does it return, after the if ( !hSnapShot ) check or after the do while loop?

Originally Posted by WasserEsser

~snip~

You've declared bModuleFound out of the scope so return bModuleFound ? reinterpret_cast< DWORD >( mEntry.modBaseAddr ) : 0; cannot be run.

Is this Module Pointer function alright?

Post a Reply

Similar Threads

Tags for this Thread