Getting the base address (Dynamic Address)

Alright, so lately I've been trying to create a little external 'hack' that forces a certain value.
The problem I'm running into with this is that the address that I wish to edit is in the format "client.dll"+offset, and the eventual address that holds the value I wish to change changes every time I relaunch the program.

How can I get my C++ program that I am writing to read and find the address that client.dll+offset points to?
I am currently using cheat engine to find the address.

Note: If I use the value that cheat engine gives me (54FF1660) in my C++ program, I can read and write to the address fine, but the address changes every time I start a new session.

The image attached shows the addresses.

Untitled.png12 KB · 135 downloads

You need a static adress, a static adress is green in CE.
You could for example search for the value in spicific adress.
If you right click that adress and you press "View memory in ..." then a window should open and you see your function.
Then right click that "Go to adress".
Then you have the asm adress (static) and this wont change.
I hope this is of any help, if not let me know!

From what i see , the 54FF1660 is a static address already , You Got 3 ways Select any of them and i will explain :

1-you can use ollydbg to get the Region & The mask to make your trainer work as a cheat engine itself

2-if your address is changing , could you give me 2 examples ? {"client1"+offset , "client2"+offset} so i can give you a simple way to get it by yourself .

3-you could use ASM+ to code your own trainer that auto-gets the address ..

Answer the 2nd one for an easy solution !

Originally Posted by Code4Dot

(Answering the 2nd Question)
Alright, the client.dll+A51660 never changes, the address "54FF1660" changes (or rather, the address of client.dll changes). What I'm really trying to ask is how to get the address of client.dll so I can then increment it by A51660 to get the address I wish to write to.

If it helps to clarify, I'm attempting to create an external 'hack' that simply writes a value to an address, using the function WriteProcessMemory()

I have everything else already set up in the way that I want it, so none of the other code is needed to be posted. If it helps to illustrate, here's a snippet.

Code:

WriteProcessMemory(hProc, (LPVOID)addressToWrite, &newVal, sizeof(newVal), NULL)

Now, addressToWrite is the variable I've assigned to... well, the address I wish to write to (self explanatory)
The problem with it is that I can't just assign it the value of "client.dll"+0xA51660. (string + address)
I need to somehow convert client.dll into an address as such, which will then allow me to get the final address.

TL;DR: "client.dll"+A51660 never changes. The output of "client.dll"+A51660 changes each run, therefore the value of "client.dll" changes each run. How do I get the value of "client.dll" in c++?

NOTE: I'm not making a dll for injection, I'm making an external .exe file to write to another program.

Thanks in Advance!

Edit: Could you perhaps explain the first method/idea/point to me if we are unable to find a solution via your second point?
And regarding your third point, I'm not all that confident with assembly, so I think that perhaps it's not the best option for me.

NOTE: As of an hour ago, the game has updated, the addresses are now slightly different, but the same problem still exists.

Originally Posted by AeroMan

"client.dll"+A566F0 IS the 'static address' (see attached image)

What I'm trying to do is get the address that "client.dll" points to every relaunch.

Thanks for the input though!

Untitled2.png80 KB · 45 downloads

Originally Posted by Kai13shadow

NOTE: As of an hour ago, the game has updated, the addresses are now slightly different, but the same problem still exists.

"client.dll"+A566F0 IS the 'static address' (see attached image)

What I'm trying to do is get the address that "client.dll" points to every relaunch.

Thanks for the input though!

so let me get it ? you are trying to get the Address of Client.dll because u can't add a string with an address ?

well , if i got the point , then please do the following easy steps to get what you want :

First write the following [IF DLL]:

Code:

 DWORD Clientshell ; //Write it one time only to avoid spam , Just make it a public [don't define it inside any code , just define it outside codes.

Then for each function , let's say inf ammo or what ever you want , write the following :

Code:

Clientshell = (DWORD)GetModuleHandle("client.dll");//gets the current base address for the module specified and converts it to Hex

DWORD Infammo = Clientshell + 0xA566F0; //now you are done , you can use that function in a normal way.


WriteProcessMemory(hProc, (LPVOID)Infammo , &newVal, sizeof(newVal), NULL);

If Not DLL :
Add the following Imports

Code:

#include <tlhelp32.h>
#include <msclr\marshal.h>
#include <msclr\marshal_cppstd.h>

and if CLI/C++ :

Code:

using namespace System::Diagnostics;

Then to get the address of the module with an external Program :

DWORD Clientshell ;
Process ^PP = Process::GetProcessesByName("Your Game's name")[0]
String ^ClientName;
marshal_context XX;
for each (System:

iagnostics::ProcessModule ^modulex in PP->Modules)
{
if (modulex->FileName->Contains("client.dll"))
{
ClientName= modulex->ModuleName;
}
LPCTSTR cstr = XX.marshal_as<const TCHAR*>(ClientName);
Clientshell = (DWORD)GetModuleHandle(cstr); // here you finally got the address of the client.dll

}

Originally Posted by Code4Dot

Code:

 DWORD Clientshell ; //Write it one time only to avoid spam , Just make it a public [don't define it inside any code , just define it outside codes.

Then for each function , let's say inf ammo or what ever you want , write the following :

Code:

Clientshell = (DWORD)GetModuleHandle("client.dll");//gets the current base address for the module specified and converts it to Hex

DWORD Infammo = Clientshell + 0xA566F0; //now you are done , you can use that function in a normal way.


WriteProcessMemory(hProc, (LPVOID)Infammo , &newVal, sizeof(newVal), NULL);

If Not DLL :
Add the following Imports

Code:

#include <tlhelp32.h>
#include <msclr\marshal.h>
#include <msclr\marshal_cppstd.h>

and if CLI/C++ :

Code:

using namespace System::Diagnostics;

Then to get the address of the module with an external Program :

Thank you for the informative reply!
I've not yet used this, but I'd like it if you could explain a few things to me about the code you've posted.
1. What does the "^" prefix to the variable names define or do?
2. What is "marshal_context"?
3. What does "->" actually do or mean?

EDIT:
So anyway, I found another method to my problem which appears to be working, however, I don't really understand how it achieves getting the address.
Appearing to be someone educated in c++, could you explain to me how it works? (a line by line explanation of the code would be brilliant if you don't mind)
I have a bit of a thing about using code I don't really understand... I've noted the few things that I understand on the code already

Code:

#include <tchar.h> //necessary to use functions/methods called in the function
#include <TlHelp32.h> //necessary to use functions/methods called in the function
static DWORD dwGetModuleBaseAddress(DWORD dwProcessIdentifier, TCHAR *lpszModuleName) { //Start of function
	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessIdentifier); //Create snapshot of process-list?
	DWORD dwModuleBaseAddress = 0; //Set dwModuleBaseAddress to a default value of 0
	if(hSnapshot != INVALID_HANDLE_VALUE) { //Check if hSnapshot is valid
		MODULEENTRY32 ModuleEntry32 = {0}; //?
		ModuleEntry32.dwSize = sizeof(MODULEENTRY32); //Get size of "MODULEENTRY32" (Why?)
		if(Module32First(hSnapshot, &ModuleEntry32)) { //??
			do { //loop
				if(_tcscmp(ModuleEntry32.szModule, lpszModuleName) == 0) { //??
					dwModuleBaseAddress = (DWORD)ModuleEntry32.modBaseAddr; //assign "dwModuleBaseAddress" the value of the address? (How?)
					break; //Break out of loop
				}
			}
			while(Module32Next(hSnapshot, &ModuleEntry32)); //part of "do loop"
		}
		CloseHandle(hSnapshot); //Close Handle (self explanitory)
	}
	return dwModuleBaseAddress; //return value stored at "dwModuleBaseAddress"
} //end

HelpGetting the base address (Dynamic Address)

Post a Reply

Similar Threads

Tags for this Thread