Search adress with offset Cheat Engine

[matigi12]

Hi I have problem with find addres. I found it in cheat engine and find pointer, but i can't copy this to program, because there are 5 offsets and i dont know how use it.






I found a way :

PID := core.Clients.list[0].PID;
ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, false, pid);
 ReadProcessMemory(ProcessHandle, Ptr(integer(core.Clients.list[0].base) + $003AB874), @myVar, SizeOf(myVar), NumberOfBytesRead);
 ReadProcessMemory(ProcessHandle, Ptr(myVar + $5c8), @myVar, SizeOf(myVar), NumberOfBytesRead);
 ReadProcessMemory(ProcessHandle, Ptr(myVar + $330), @myVar, SizeOf(myVar), NumberOfBytesRead);
 ReadProcessMemory(ProcessHandle, Ptr(myVar + $35c), @myVar, SizeOf(myVar), NumberOfBytesRead);
 ReadProcessMemory(ProcessHandle, Ptr(myVar + $4), @myVar, SizeOf(myVar), NumberOfBytesRead);
 ReadProcessMemory(ProcessHandle, Ptr(myVar + $7e0), @myVar, SizeOf(myVar), NumberOfBytesRead);

[ufo]

Whta's the type of myVar ?
You should be reading 4 bytes so if myVar is smth else than integer then you've got to change that.

Besides in the screeny you've got the starting pointer address = $3FBB14, yet in the code posted you have $3AB874, and different offsets...

[matigi12]

I search again (next pointer) and change values.
myVar DWORD
NumberOfBytesRead Integer
In code where is $5c8 it is last line in cheat engine, its on picture + 14

[ufo]

You should be reading the pointer values from down to top looking at the CheatEngine.
So from what you're saying seems like you're ok with that.
DWORD is also sizeOf = 4 so it's ok.

Try making one more, final RPM:

ReadProcessMemory(ProcessHandle, Ptr(myVar), @myVar, SizeOf(myVar), NumberOfBytesRead);

In the pic, you've posted, you can see that offset $7F0 leads you to a memory address $020984D8.
And at the top of the box you see value of that address is 5.
So you're simply missing the final ReadProcessMemory (as noted above).


HTH

[matigi12]

you can do that
Var
myvar : integer;
begin
myvar := readinteger($3AB874 + base);
myvar := readinteger(myvar +$5c8);
...
myvar:= readinteger(myvar + $7e0);
I find it in Muttley's source Insanus bot with zoom map.
http://code.google.com/p/insanusbot/source/browse/trunk/Objects/GUI/GUIMap.pas
27 to 32 line

[ufo]

Yes, you can...
But the result you get your way (with your pointer) is memory address of the value instead of the value itself.

Muttley's source pointer you brought up is alot simplier pointer than yours thus the fewer number of RPM.