Start: Address

[Blaster_89]

So my PC is saying the address is Tibia.exe+5E6E6C. Is that correct? How can I get the BaseAddress of Tibia.exe?

Language?

C#

[code=c#]
Process p; // instantiate this before use
int baseAddress = p.MainModule.BaseAddress.ToInt32();
[/code]

[XtrmJash]

Then I must convert the int into intptr for use with kernel32.dll's readprocessmemory function? Could you do me a massive factor and just write the code needed so I can just stick it on either my xp or 7 machine, run it, read it, and learn from it please? Must have spent 20+ hours on this single section of code

Once I've Got some working code I can begin using it with my own functions to make something useful. Would be a great help and I promise I'll share my new knowledge!!! Lol

[Blaster_89]

Then I must convert the int into intptr for use with kernel32.dll's readprocessmemory function? Could you do me a massive factor and just write the code needed so I can just stick it on either my xp or 7 machine, run it, read it, and learn from it please? Must have spent 20+ hours on this single section of code

Once I've Got some working code I can begin using it with my own functions to make something useful. Would be a great help and I promise I'll share my new knowledge!!! Lol

Align the addresses at startup, don't do it every time you read memory.
You can see how klusbert did it here: http://code.google.com/p/tibiaapi/source/browse/trunk/tibiaapi/Addresses/Versions/Version910.cs
Note that 0x400000 is the base address without ASLR.

[XtrmJash]

Once I've got the memory reading code together and the addresses sorted I will do so, then I'll set a function to which I can pass an address to get the memory read, of course it will be object orientated and each address can have other info stored if needed, just gotta get memory reading down

[joaom182]

Slots Head, Armor, Legs e etc has a memory address static, but the health, mana e etc memory adress, not is static.. because ASLR, how i can fix this!?

[Sketchy]

Then I must convert the int into intptr for use with kernel32.dll's readprocessmemory function?

You don't need to use IntPtr, it depends entirely upon how you define your function prototype for ReadProcessMemory. If you really want you could use a normal integer instead of IntPtr like so:

[DllImport("kernel32.dll")]
static extern Int32 ReadProcessMemory(UInt32 process, UInt32 address, [In, Out] byte[] buffer, UInt32 size, out UInt32 readCount);

If you don't care about the number of bytes it read/wrote you could pass the last parameter by value (ie: remove the out keyword) with a value of 0, this eliminates the need to define a variable for the count.

You should take note that the above prototype is for a 32-bit application only, it won't work for a 64-bit application as all 5 parameters (yes, even the size) are increased to 64 bits. This leads to why IntPtr is commonly used, its size adjusts to whatever platform the application is compiled for (ie: 32 for 32-bit, 64 for 64-bit).

[snot]

I'm some hours trying to find how can I get the Tibia base address in vc++. Can someone explain me?

[ResQue1980]

Thanks for the info. its quick clean and simple to follow, and with pictures what more could you ask for

[ruffs]

also if you dont know what the id is between and dont know exact, just use the unkown initial value scan, scan unchanged (3-5 times), put helm on or remove then scan changed value, then leave helm alone, scan for unchanged and do so until you can find the correct address, just thought i'd add it since it wasnt said =]