Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Finding the correct baseaddress

I realized that my version of getting the correct baseaddress was wrong

Process[] iexp = Process.GetProcessesByName("Solitaire");
if (iexp.Length == 0) {
    //EXIT
}
Process internet = iexp[0];
uint baseAddress = (uint)internet.MainModule.BaseAddress.ToInt64();

but the baseaddress is wrong

I also looked in MSDN but this code is very strange and gives me an infinite loop.

I hope you can help me because I can't find any example.

EDIT :

 ReadProcessMemory(readHandle, ((IntPtr)(((baseAddress) + 0x14) + 0x50)), bytes, (UIntPtr)4, ref rw);

Here i made an image of my desktop. Im realy confused, maybe someone knows where i made a mistake. http://i.stack.imgur.com/50lva.jpg

like image 652
Maik Klein Avatar asked Nov 24 '11 22:11

Maik Klein


1 Answers

If you want what I think you want, I can only think of a few ways to do it, none of them are .NET built-in though...

  1. Use P/Invoke to return the base address of the startup executable.

    [DllImport("kernel32.dll")]
    public static extern IntPtr GetModuleHandle(string lpModuleName);
    
  2. Returns the base address of the executable containing MyClass

    Marshal.GetHINSTANCE(typeof(MyClass).Module)
    
  3. Return a handle to the current module using:

    Marshal.GetHINSTANCE(this.GetType().Module)
    
like image 79
Brian Deragon Avatar answered Oct 03 '22 07:10

Brian Deragon