CODEWITHSUNDEEP
c++memorydll
majidarif
majidarif

Reputation: 20025

DLL injection and reading memory by offset

I injected a DLL to an exe. Now I need to read data from a specific offset. My code from the DLL:

DWORD ExeBaseAddress = (DWORD)GetModuleHandleA(0); 
// HANDLE baseAddr = GetModuleHandleA(0)

uint16_t value = ExeBaseAddress + 0x7198BC + 0x70e;

cout << value << endl;

Problem is it doesn't give me the value I expect which is 1000. It also doesn't give me the right address.

Using a memory reading software I can get the CORRECT value. See:

cheatengine

But I am still getting the wrong value from the code even though I'm using the exact same offset from the memory reading app. So what am I missing?

I tried this but its still giving me the wrong value.

HANDLE ExeBaseAddress = GetModuleHandleA(0);

uintptr_t p = (uintptr_t)ExeBaseAddress + 0x7198BC + 0x70e;
int value = *reinterpret_cast<int *>(p);

cout << ExeBaseAddress << " - " << value << endl;

Upvotes: 1

Views: 2741

Answers (1)

Abhineet
Abhineet

Reputation: 5399

From all the long comments and chats (some basic input too) with the OP, the solution found its way,

The exe loaded have the base address stored of another PE at the location 0x7198BC. This Base Address + offset(0x70E) have the desired value contained.

HANDLE ExeBaseAddress = GetModuleHandleA(0);

/*ExeBaseAddress is a HANDLE, so it's size is unknown to the compiler.
 That's why, we cast it to (unintptr_t). 
 And overall, we need an address which can be dereferenced,
 to get the value kept at the location, so cast it to (uintptr_t*)*/

uintptr_t *p = (uintptr_t*)((uintptr_t)ExeBaseAddress + 0x7198BC);
uintptr_t ModuleBaseAdrs = (DWORD&)*p ;
printf( "ModBaseAdrsLoc - %p, ModuleBaseAdrs - %X\n", p, ModuleBaseAdrs ) ;

uintptr_t *ValLoc = (uintptr_t *) (ModuleBaseAdrs + 0x70E);
DWORD Val = (DWORD&)*ValLoc ;
printf( "ValLoc - %p, Val - %u\n", ValLoc, Val ) ;

Upvotes: 3

Related Questions