Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

C++ Read Memory Address / Pointer & Offset

So, I have injected a DLL into a process (a game) so that I can read from the process memory.

I want to get the current game time, and I've found the static base address & offset of it using Cheat Engine :

"game.exe"+0158069C

Offset : 14

And this is the code I've tried to get the float value (current game timer) :

//Offsets
#define BASETIME 0x158069C
#define OFFSET 0x14

void CurrentTime() {

    float *time;
    DWORD *BaseAddress = (DWORD*)GetModuleHandle(NULL);
    DWORD *BaseTimeAddress = (DWORD*)(BaseAddress + BASETIME);
    time = (float*)(BaseTimeAddress + OFFSET);

    if (BaseTimeAddress && time) //Check the addresses, not values.
    {
        std::cout << "Base Address : " << BaseAddress << endl; // Correct
        std::cout << "Base Time Address &: " << &BaseTimeAddress << endl; // Not correct
        std::cout << "Base Time Address : " << BaseTimeAddress << endl; // Not correct
        std::cout << "Time Value : " << *time << endl; // Not correct
    }
}

The cout of the Base Address is correct (I can check it with Cheat Engine), but after that everything is wrong, can you help me ? I'm stuck with this and I've tried many things ... :/

Thank you in advance,

like image 419
Aeio Much Avatar asked Apr 30 '15 02:04

Aeio Much


2 Answers

I am assuming that you want to increment your pointer by OFFSET and BASETIME bytes. If so, your code is not incrementing on a byte basis. Instead it is incrementing by sizeof(DWORD) * OFFSET bytes.

The reason is that the base pointer type is DWORD*, and incrementing pointers of this type by n will get you to n * sizeof(DWORD) away from the start. This will not do the job.

The easiest solution is to cast to a char * when doing the pointer arithmetic, so that the increment is going by sizeof(char), not sizeof(DWORD):

 DWORD *BaseTimeAddress = (DWORD*)((char *)BaseAddress + BASETIME);
 time = (float*)((char *)BaseTimeAddress + OFFSET);

Now, whether where you end up is the data you want, that is something I can't answer. However if your goal was to increment on a byte basis, then you should make the corrections as shown above.

like image 120
PaulMcKenzie Avatar answered Sep 30 '22 00:09

PaulMcKenzie


Thank you PaulMcKenzie I got it,

So for those who struggle like me, this is the final code who actually work :

//Offsets
#define BASETIME 0x0158069C
#define OFFSET 0x14

void CurrentTime() {

    DWORD* BaseAddress = (DWORD*)GetModuleHandle(NULL);
    DWORD* address = (DWORD*)((char*)BaseAddress + BASETIME);
    address = (DWORD*)((char*)*address + OFFSET);
    float currentTime = *(float*)address;

    if (address && currentTime)
    {
        std::cout << endl <<"----------------" << endl;
        std::cout << "Base Address : " << BaseAddress << endl;
        std::cout << "----------------" << endl;
        std::cout << "Time Address : " << address << endl;
        std::cout << "----------------" << endl;
        std::cout << "Time Value : " << currentTime << endl;
        std::cout << "----------------" << endl << endl << "#> ";
    }

}
like image 30
Aeio Much Avatar answered Sep 30 '22 02:09

Aeio Much