Base Address + offset

and after that, does it return the actual address?

Toolhelp32Snapshot will give you the base address and module size of each module, then you simple add the offset to get to where you need to go.

will try that man, thanks. Any problem i might post here again

- - - Updated - - -

seems like the base address is 0x0000015224020B48 (i got a bunch of similars using another function earlier, i didnt know which one to pick cause it was spamming), but i cant get the thing to work, im honestly stuck. By the way, i used a code made by someone to get the base addres(yeah it uses createtoolhelp32snapshot).
print me32.dwSize
print me32.th32ModuleID
print me32.th32ProcessID
print me32.GlblcntUsage
print me32.ProccntUsage
print me32.modBaseAddr
print me32.modBaseSize
print me32.hModule
print me32.szModule
print me32.szExePath

Use me32.szModule to check for "codwew.exe", and log the base address for that. You only need to do this once, the module won't shift around during operation.

Yeah during the operation it wont change, but how do i use the base address + the offset together? its giving me an error "expected str, got int instead" when i try to add the offset to it. For example: self.xpMultiplier1 = (me32.modBaseAddr)+0x591938



print(me32.szModule)
print(me32.modBaseAddr)
print(me32.th32ModuleID)


b'CoDWaWmp.exe'
<ctypes.wintypes.LP_c_byte object at 0x0000022743F10BC8>
1
b'ntdll.dll'
<ctypes.wintypes.LP_c_byte object at 0x0000022743F10BC8>
1
b'wow64.dll'
<ctypes.wintypes.LP_c_byte object at 0x0000022743F10BC8>
1
b'wow64win.dll'
<ctypes.wintypes.LP_c_byte object at 0x0000022743F10BC8>
1
b'wow64cpu.dll'
<ctypes.wintypes.LP_c_byte object at 0x0000022743F10BC8>
1



got told that the BaseAddress for any CoD is static and i couldve just used the address that is displayed on CE

thanks anyway, indeed learned stuff from here