What's wrong with reading mana?

[Davlog]

    tibiaWindow = FindWindow( L"TibiaClient", NULL);
    DWORD PID;
    GetWindowThreadProcessId( tibiaWindow, &PID );
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID); //Open Process for Read/Write
    short mana = 0;

    if( !ReadProcessMemory(hProcess, (void*)0x3C2D00, &mana, 2, 0) )
        statusBar()->showMessage( "Error occured ", 3000 ); //shows me if failed
    else
        statusBar()->showMessage( QString::number(mana), 3000 ); //Shows me mana

I've checked the address of mana and it should be tibia.exe+0x3C2D00. However, this code above does not work. It always fails to read the process memory. Anyone knows whats wrong?

[jo3bingham]

I believe Mana is one of the addresses that are XOR'd. This thread should help: http://tpforums.org/forum/threads/49...ll=1#post44519

[Davlog]

Here's an update.

This code works but I got the wrong address. CheatEngine says I have to get the baseaddress of tibia.exe and add 0x3C2D00 to it.
Now I just need to find out how to get the base address of tibia.exe...
Gonna look it up somewhere but so far I got nothing! -.-

[Davlog]

DWORD MainWindow::getBaseAddress(DWORD dwProcessIdentifier, TCHAR *lpszModuleName)
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessIdentifier);
    DWORD dwModuleBaseAddress = 0;
    if(hSnapshot != INVALID_HANDLE_VALUE)
    {
        MODULEENTRY32 ModuleEntry32;
        ModuleEntry32.dwSize = sizeof(MODULEENTRY32);
        if(Module32First(hSnapshot, &ModuleEntry32))
        {
            do
            {
                if( wcscmp(ModuleEntry32.szModule, lpszModuleName) == 0)
                {
                    dwModuleBaseAddress = (DWORD)ModuleEntry32.modBaseAddr;
                    break;
                }
            }
            while(Module32Next(hSnapshot, &ModuleEntry32));
        }
        CloseHandle(hSnapshot);
    }
    return dwModuleBaseAddress;
}

This is supposed to return the base address... doesn't work! Any ideas whats wrong?

[Davlog]

Got it now :

DWORD MainWindow::getBaseAddress(DWORD dwProcessId)
{
    WCHAR* lpModuleName = L"tibia.exe";
    MODULEENTRY32 lpModuleEntry;
    HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );

    if(!hSnapShot)
        return 0;

    lpModuleEntry.dwSize = sizeof(lpModuleEntry);
    BOOL bModule = Module32First( hSnapShot, &lpModuleEntry );
    while(bModule)
    {
        if(!wcsicmp(lpModuleEntry.szModule, lpModuleName ) )
        {
            CloseHandle( hSnapShot );
            return (DWORD)lpModuleEntry.modBaseAddr;
        }
        bModule = Module32Next( hSnapShot, &lpModuleEntry );
    }
    CloseHandle( hSnapShot );
    return 0;
}

this seems to work.