Memory Reading - Printable Version

Memory Reading - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Coding (https://sinister.li/Forum-Coding--71)
+--- Thread: Memory Reading (/Thread-Memory-Reading)

Memory Reading - suspecteme - 02-01-2014

Hi guys i am trying to read this static address:74EB4720 with this offset:264 i have them saved to a INI. My script for some reason it only returns a 0. Please take a look for me ty Biggrin

Code:
#RequireAdmin
#include "[Includes]\NomadMemory.au3"
$INI=@ScriptDir&"\options.ini"
$StaticAddress =IniRead($INI,"GameClient","BaseAddress",0);read and declare Static Address from ini
$ProcName=IniRead($INI,"GameClient","ProcName",0);read and declare Proc Full Name from ini
$ClientName=StringSplit($ProcName,".");read and declare Proc short name from ini
$Value=IniRead($INI,"GameClient","AddValue",0);read and declare Value from ini
$Offset=IniRead($INI,"GameClient","Offset",0);read and declare offset from ini
SetPrivilege("SeDebugPrivilege", 1);set Privileges

$PID = ProcessExists($ProcName);get PID for program
Global $Offset[1] = ["0x" & dec($Offset)]; declare offset and or offset
$StaticAddress = "0x"&$StaticAddress;Static address Offsets
$openmem = _MemoryOpen($PID);Open PID memory
$baseADDR = _MemoryGetBaseAddress($openmem, 1);Recover PID Base Address
$finalADDR = "0x" & Hex($baseADDR + $StaticAddress);Get final read addresss
$Mread = _MemoryPointerRead($finalADDR, $openmem, $Offset, 'dword');Read pointer $StaticAddress w/ $Offset added
_MemoryClose($openmem);Close Memory
MsgBox(0, "Result", "My HP = "&$Mread[1],-1,"");Display Results of pointer

RE: Memory Reading - suspecteme - 02-02-2014

OK well I got it working and it works well here it is:

Code:
#RequireAdmin
#include "[Includes]\NomadMemory.au3"
#include "[Includes]\String.au3"
$INI=@ScriptDir&"\options.ini"
$StaticAddress =IniRead($INI,"GameClient","StaticAddress",0)
$ProcName=IniRead($INI,"GameClient","ProcName",0)
$Value=IniRead($INI,"GameClient","AddValue",0)
$CurHPoffset=IniRead($INI,"Offsets","CurHPOffset",0)
$MaxHPoffset=IniRead($INI,"Offsets","MaxHPOffset",0)

SetPrivilege("SeDebugPrivilege", 1)
$HX_REF="0123456789ABCDEF"

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;USE STATIC TO GET BASE DYNAMIC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$PID = _MemoryOpen(ProcessExists($ProcName));GET PID OF PROC
$ReadBaseAdress =  _MemoryRead("0x"&hex($StaticAddress), $PID,'dword');READ STATIC ADDRESS TO GET DYNAMIC BASE ADDRESS
$AddressCorrection = StringRegExpReplace($ReadBaseAdress, "^0*(d+)", "$1"); CORRECTLY CONVERT ADDRESS
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;USE BASE DYNAMIC TO ADD OFFSETS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$CurHPnew=$AddressCorrection+$CurHPoffset
$hexaddress=_DecimalToHex($CurHPnew, 9)
$curHPaddress=StringTrimLeft($hexaddress,1)
$curHPvalue =  _MemoryRead("0x"&$curHPaddress, $PID,'dword');READ DYNAMIC ADDRESS w/ OFFSET
MsgBox(-1,"","Current HP Value="&$curHPvalue,-1,"")

_MemoryClose($PID)


;dec to hex func

Func _DecimalToHex($hx_dec, $hx_length = 21)

If IsInt($hx_dec) = 0 Then
SetError(1)
        MsgBox(0,"Error","Wrong input, try again ...")
Return ""
EndIf
Local $ret = "", $Ii, $hx_tmp, $hx_max
If $hx_dec < 4294967296 Then
If $hx_length < 9 Then Return Hex($hx_dec, $hx_length)
If $hx_length = 21 Then
$ret = Hex($hx_dec)
While StringLeft($ret, 1) = "0"
$ret = StringMid($ret, 2)
WEnd
Return $ret
EndIf
EndIf
For $Ii = $hx_length - 1 To 0 Step -1
$hx_max = 16 ^ $Ii - 1
If $ret = "" And $hx_length = 21 And $hx_max > $hx_dec Then ContinueLoop
$hx_tmp = Int($hx_dec/($hx_max+1))
If $ret = "" And $hx_length = 21 And $Ii > 0 And $hx_tmp = 0 Then ContinueLoop
$ret &= StringMid($HX_REF, $hx_tmp+1, 1)
$hx_dec -= $hx_tmp * ($hx_max + 1)
Next
$ret=String($ret)
If $hx_length < 21 And StringLen($ret) < $hx_length Then SetError(1)
Return $ret
EndFunc ;==>_DecToHex()

; ----------------------------------------------------------------
; Hex to Decimal Conversion ; Correct till Decimal 65789 ?!
Func _HexToDecimal_NotCorrect($Input)
Local $Temp, $i, $Pos, $Ret, $Output

If StringRegExp($input,'[[:xdigit:]]') then
$Temp = StringSplit($Input,"")

For $i = 1 to $Temp[0]
    $Pos = $Temp[0] - $i
    $Ret = Dec (Hex ("0x" & $temp[$i] )) * 16 ^ $Pos
    $Output &= $Ret
Next
    return $Output
Else
    MsgBox(0,"Error","Wrong input, try again ...")
    Return
EndIf
EndFunc

; Decimal To Hex Conversion

But now my problem is something different ;

When i close the window in cheat engine; the window that accesses op codes and allows you to see what is accessing a address"the dynamic address for my HP", well when i close that my static addresses stop responding and always return 0.

So let me re-state that this script will only returns correct values if CE is running and finding out what acceses the dynamic address, but if its not running the Base static address will point to another address that has a value of 0.

thank you for your help

RE: Memory Reading - suspecteme - 02-02-2014

Ok i found out what was wrong the static address i was reading was part of the CE debugger itself LOL i feel dumb now oh well... now too look for some better pointers

RE: Memory Reading - suspecteme - 02-04-2014

OK now im having trouble getting the dynamic address i need from this pointer

[Image: screen_zps379a4009.png?t=1391493416]

[Image: screen_zps379a4009.png?t=1391493416]

I was hoping some one could make me a quick example or give some help

I am using NomadMemory.au3 and gotten it to read address no problem and return correct values but it seems i am having trouble with reading pointers with multiple offsets. If i can get that dynamic address circled in red i can do the rest Biggrin

. ty ty ty

RE: Memory Reading - suspecteme - 02-05-2014

Ok well im trying to read a pointer to get a dynamic address to base all my memory reading off of.
Pointer: "name.bin" + 0000CB78 + 0 + 1f4 + 9c + 60C + 30
So in that saying this is what i have come up with but for some reason it always returns a wrong end address.

Code:
#RequireAdmin
#include "[Includes]\NomadMemory.au3"
$INI=@ScriptDir&"\options.ini" ;declare the INI directory
$ProcName=IniRead($INI,"GameClient","ProcName",0) ;read ini to get $ProcName = WhatEverProccess.BIN
$BaseOffset=IniRead($INI,"Offsets","BaseOffset",0) ;read ini to get $BaseOffset = 0000CB78 
$Offset1=IniRead($INI,"Offsets","Offset1",0) ;read ini to get offfset 1
$Offset2=IniRead($INI,"Offsets","Offset2",0) ;read ini to get offfset 2
$Offset3=IniRead($INI,"Offsets","Offset3",0) ;read ini to get offfset 3
$Offset4=IniRead($INI,"Offsets","Offset4",0) ;read ini to get offfset 4
$Offset5=IniRead($INI,"Offsets","Offset5",0) ;read ini to get offfset 5
SetPrivilege("SeDebugPrivilege", 1)

$pid = ProcessExists($ProcName) ; Get Process Handle  TESTED WORKS GOOD
$OpenProcMemory = _MemoryOpen($pid) ; Open Process Handle  TESTED WORKS GOOD
$BaseAddress="0x"&StringRight(hex(_MemoryModuleGetBaseAddress($pid, $ProcName) + dec($BaseOffset)),8) ; Get Base Address  TESTED WORKS GOOD
$ReadBaseAddress="0x"&hex(StringRight(_MemoryRead($BaseAddress, $OpenProcMemory),8)) ; Read Base Address  TESTED WORKS GOOD





#region ~~~~~~~~~~~~~~~~~~ POINTER RETURNS WRONG ADDRESS ~~~~~~~~~~~~~~~~~~~~~~~ ; This Region Returns Wrong Addresses
local $Offsets[5] = [0, Dec(Offset1), Dec(Offset2),dec(Offset3),dec(Offset4)]; declare offsets

$PointerReadAddress = _MemoryPointerRead($ReadBaseAddress, $OpenProcMemory, $Offsets) ;Read Pointer
$Read=StringRight ( $PointerReadAddress[0], 8); Only uses last 8 digits of string "Removes uneeded 0's"
MsgBox(0,"TEST READ","Pointer Read: "&$Read,-1,"") ;Show me address of this pointer

_MemoryClose($OpenProcMemory)
#endregion ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~












;=================================================================================================
; Function:   _MemoryModuleGetBaseAddress($iPID, $sModule)
; Description:     Found this on the internets, seems to open up a DLL running within a process and
;					gets the base offset?
; Parameter(s):  $PID - process id
;               $sModule String representing the name of the DLL (not entireley sure)
; Requirement(s):   The $ah_Handle returned from _MemoryOpen.
; Return Value(s):  On Success - Returns the destination address.
;               On Failure - Returns 0.
; Author(s):        Unknown
; Note(s):      This is NOT my code, and im not even sure if its what is required
;=================================================================================================

	Func _MemoryModuleGetBaseAddress($iPID, $sModule)
	If Not ProcessExists($iPID) Then Return SetError(1, 0, 0)
	If Not IsString($sModule) Then Return SetError(2, 0, 0)
	Local   $PSAPI = DllOpen("psapi.dll")
	;Get Process Handle

	Local   $hProcess
	Local   $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020) ; CREATE_THREAD, QUERY_INFORMATION, VM_OPERATION, VM_READ, VM_WRITE
	If $iPID > 0 Then
		Local $hProcess = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $iPID)
		If $hProcess[0] Then
			$hProcess = $hProcess[0]
		EndIf
	EndIf
	;EnumProcessModules
	Local   $Modules = DllStructCreate("ptr[1024]")
	Local   $aCall = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($Modules), "dword", DllStructGetSize($Modules), "dword*", 0)
	If $aCall[4] > 0 Then
		Local   $iModnum = $aCall[4] / 4
		Local   $aTemp
		For $i = 1 To $iModnum
			$aTemp =  DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", Ptr(DllStructGetData($Modules, 1, $i)), "wstr", "", "dword", 260)
			If $aTemp[3] = $sModule Then
				DllClose($PSAPI)
				Return Ptr(DllStructGetData($Modules, 1, $i))
			EndIf
		Next
	EndIf
	DllClose($PSAPI)
	Return SetError(-1, 0, 0)
EndFunc