winapi - Having issues getting the module base address C++ -
i trying make program store value 500 calculator's memory address mr (memory restore) button on calculator application. know address integer "calc.exe"+00073320 + 0 + c
if use program cheat engine, can current address instance of calculator.exe i'm running, , write fine way. however, since not static address, need way module base address.
i tried using getmodulebase function (see code below) base address of calc.exe, issue cannot base address. function returns 0 instead of correct address.
i debugged , found in getmodulebase function, not cycling once through while loop because bmodule returning 0 module32first function.
#include <tchar.h> #include <windows.h> #include <tlhelp32.h> #include <iostream> #include <psapi.h> #include <wchar.h> #pragma comment( lib, "psapi" ) using namespace std; dword getmodulebase(lpstr lpmodulename, dword dwprocessid) { moduleentry32 lpmoduleentry = {0}; handle hsnapshot = createtoolhelp32snapshot( th32cs_snapmodule, dwprocessid ); if(!hsnapshot) return null; lpmoduleentry.dwsize = sizeof(lpmoduleentry); bool bmodule = module32first( hsnapshot, &lpmoduleentry ); while(bmodule) { if(!strcmp( lpmoduleentry.szmodule, lpmodulename ) ) { closehandle( hsnapshot ); return (dword)lpmoduleentry.modbaseaddr; } bmodule = module32next( hsnapshot, &lpmoduleentry ); } closehandle( hsnapshot ); return null; } int main() { hwnd hwnd = findwindow(0, "calculator"); dword baseaddr; if(hwnd == 0){ messagebox(0, "error cannot find window.", "error", mb_ok|mb_iconerror); } else { dword proccess_id; getwindowthreadprocessid(hwnd, &proccess_id); handle hprocess = openprocess(process_all_access, false, proccess_id); if(!hprocess){ messagebox(0, "could not open process!", "error!", mb_ok|mb_iconerror); } else { int newdata = 500; baseaddr = getmodulebase("calc.exe",proccess_id); //getmodulebase returning 0, not getting correct base address dword newdatasize = sizeof(newdata); if(writeprocessmemory(hprocess, (lpvoid)0x002413fc, &newdata, newdatasize, null)){ cout << "memory written." << endl; } else { cout << "memory failed write." << endl; } closehandle(hprocess); } } return 0; }
summary: cannot correct base address using getmodulebase function, , need figure out doing wrong can correct base address "calc.exe" process.
you should read modules this:
#include <windows.h> #include <tlhelp32.h> #include <iostream> //you don't have use function if don't want to.. int strcompare(const char* one, const char* two, bool casesensitive) { #if defined _win32 || defined _win64 return casesensitive ? strcmp(one, two) : _stricmp(one, two); #else return casesensitive ? strcmp(one, two) : strcasecmp(one, two); #endif } //you read module information this.. moduleentry32 getmoduleinfo(std::uint32_t processid, const char* modulename) { void* hsnap = nullptr; moduleentry32 mod32 = {0}; if ((hsnap = createtoolhelp32snapshot(th32cs_snapmodule, processid)) == invalid_handle_value) return mod32; mod32.dwsize = sizeof(moduleentry32); while (module32next(hsnap, &mod32)) { if (!strcompare(modulename, mod32.szmodule, false)) { closehandle(hsnap); return mod32; } } closehandle(hsnap); return {0}; } int main() { //change process id below.. byte* baseaddr = getmoduleinfo(5172, "calc.exe").modbaseaddr; std::cout<<"base address: "<<(void*)baseaddr<<"\n"; return 0; }
edit: after further investigation, found visual studio compiling x32 platform calc.exe x64 process..
to visual studio compile x64 need following:
then click , select "new" following drop-down menu:
next in following drop down, select x64:
save settings , rebuild project , should work..
Comments
Post a Comment