ReadProcessMemory - Adding 5 Offsets to a Pointer

Question

Now, I know questions similar to this may have been asked before, and trust me, for the past couple days I've been looking around the internet for an already-answered situation, however I still can't get this to work and to be honest, not sure why it isn't working. What I am attempting to do is get the ammo value in a game. readMemory, which is an int, is supposed to contain this value, however it's simply outputting 0.

    ReadProcessMemory(handle, (PBYTE*)(base_adr), &pAddress1, sizeof(pAddress1), 0);
    ReadProcessMemory(handle, (PBYTE*)(pAddress1 + offset_1), &pAddress2, sizeof(pAddress2), 0);
    ReadProcessMemory(handle, (PBYTE*)(pAddress2 + offset_2), &pAddress3, sizeof(pAddress3), 0);
    ReadProcessMemory(handle, (PBYTE*)(pAddress3 + offset_3), &pAddress4, sizeof(pAddress4), 0);
    ReadProcessMemory(handle, (PBYTE*)(pAddress4 + offset_4), &pAddress5, sizeof(pAddress5), 0);

    while (1)
    {
        ReadProcessMemory(handle, (PBYTE*)(pAddress5 + offset_5), &readMemory, sizeof(readMemory), 0);
        cout << readMemory << endl;
    }

Obviously, this isn't an efficient way of adding the pointers (nor is it a working way, I guess), and I'm looking for someone who can point me into the right direction. Thanks, and once again sorry for the (most likely in your eyes) a basic question.

DWORD base_adr = 0xCC8408;
const DWORD offset_1 = 0x23C;
const DWORD offset_2 = 0x7A4;
const DWORD offset_3 = 0x34C;
const DWORD offset_4 = 0x5B0;
const DWORD offset_5 = 0x2D8;
DWORD pAddress1;
DWORD pAddress2;
DWORD pAddress3;
DWORD pAddress4;
DWORD pAddress5;

@RbMm well, I'm attempting to get the ammo value in a game, however 'readMemory' (int) outputs as 0. Will make an edit to clarify for everyone, sorry. — 4Dimensions, Apr 20 '17 at 20:58
@4Dimensions recommend setting up a simple program that contains a simple data structure to use as your test dummy. When you can read and modify the memory of the test dummy, then start trying to manipulate "real" programs. — user4581301, Apr 20 '17 at 21:01
if api fail - call GetLastError for get more info why. but faster of all you use wrong address — RbMm, Apr 20 '17 at 21:02
It would help if you showed us the declaration of `pAddress1`, `pAddress2`, etc. Adding a value to a pointer requires knowledge of what that pointer is that you're adding to. — PaulMcKenzie, Apr 20 '17 at 21:02
Check and report on the return code (using GetLastError as RbMm suggests) — DrC, Apr 20 '17 at 21:04
@RbMm the address and offsets are not wrong. I've manually added them to cheat engine many times to ensure they're correct. It does indeed point to the ammo's address every time. — 4Dimensions, Apr 20 '17 at 21:09
you even not write which call fail. if addresses will be correct - will be not fail. faster of all the `base_adr`. and not use `DWORD` for address. — RbMm, Apr 20 '17 at 21:19
@4Dimensions -- First, let's make sure you're aware of what happens when you add a value to a `DWORD` pointer. If the DWORD address is say, 4, when you add 1 to it, you don't get the address equal to 5. You get 4 + 1 * sizeof(DWORD), which is 8 (if we assume that sizeof(DWORD) is 4). So is your goal really to do byte size pointer addition? If so, your code is wrong. — PaulMcKenzie, Apr 20 '17 at 21:39
@4Dimenisons -- And if you are supposed to do byte sized offsets, not DWORD sized offsets, the correction is to cast the DWORD* to a char* and *then* do the addition, not do the addition and then cast the whole thing to a `PBYTE*`. Something like `(PBYTE*)((char *)pAddress1 + offset_1)`. However I don't know if that was supposed to be your intention, so won't post it as an answer. — PaulMcKenzie, Apr 20 '17 at 21:49
@PaulMcKenzie, there are no `DWORD*` pointers being used in the OP's code example, only `DWORD` integers that receive pointer address values from the other process. Big difference. Everything you said is good to know in general, but does not apply in this case. However, casting the calculated values to `PBYTE*` is logically wrong but generally OK (any pointer type will do), since `ReadProcessMemory()` is expecting a `void*` pointer, and any pointer is implicitly convertible to `void*`. The values should be casted to `void*` instead of `PBYTE*`. — Remy Lebeau, Apr 20 '17 at 21:56

score 0 · Answer 1 · edited May 23 '17 at 10:31

Reading the MSDN article on function ReadProcessMemory the first thing I notice is this:

The entire area to be read must be accessible or the operation fails.

First thing I'd suggest is you check the return value of those calls. I'm pretty sure they all return 0 for "failed" so next thing you do is you call GetLastError to find out why exactly did it fail.

Once you figure that out you'll be able to fix it. More likely than not the problem is that your program doesn't have sufficient privileges to access another process's memory.

Quick search pops this OS article on how to properly access other process's memory: How is it possible to access memory of other processes?

ReadProcessMemory - Adding 5 Offsets to a Pointer

1 Answers1