I believe it was said already but...
Get the module base address.
I'm pretty sure there is simpler solution or more effective, but I did this when I was playing around with solitaire at the very beggining.
Code:
MODULEENTRY32 mEntry32;
HANDLE hSnapMods = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pId);
if(Module32First(hSnapMods, &mEntry32) == TRUE)
{
do
{
if(strcmp(mEntry32.szModule, "solitaire.exe") == 0)
{
mAddress = (DWORD)mEntry32.modBaseAddr + appOffSet;
break;
}
}
while(Module32Next(hSnapMods, &mEntry32) == TRUE);
}
<pId> is the process id.
<mEntry32.modBaseAddr> will be the module base address.
Now instead of copying it and see that works (or not), try to understand first what is in there.