1

I'm totally new to this reverse engineering stuff.

I'm working on my own project and trying to parse poker games from PokerStars application. I have already done with injecting my DLL to the app, but I don't know what to do next.

I got module base address, created a hexdump function, and tried to go along process virtual memory, but it takes enormous amount of time. For now, I only found a region of memory where some source code is located. I've seen on GitHub project of PokerStars bot, so I know that it's possible to find in memory data I need, but I really don't know how. Can you give me advice?

Also, the game is open in another window, so I suppose the main program creates another thread for it. So how can I find the base address of this thread?

1 Answer 1

1

In order to "extract" (the specific) data from another process you need the correct memory address(es) and preferably it's datatype(s) and size of the datatype. (e.g. signed/unsigned int at location 0x[....])

You should also consider (depending on the datatype and algorithm), that such addresses can change during runtime (and/or upon starting your program)

Some addresses and their (context) values are fixed, and can always reside on the same location in memory. (e.g. mapping, declared constants, etc.) (However a new build/patch of the program can change such addresses)

Be careful of possible pointers that you need to follow, until you got the final address where the value resides.

Some addresses may also be inaccessible, invalid or restricted to read from. (Depending on OS, etc.) (e.g. this might be the case if it's a java process or differences between x86 and x86_64 processes)

You don't need to inject a DLL in order to just read data from a foreign process.

Injecting a DLL is primarily used to execute (your) code in that process' space, which includes handles, etc.

Please be careful if you intent to (over)write values in foreign processes. This can be detected and might crash/damage processes/files if not careful.

For now, without much effort and hassle, I recommend using CheatEngine to learn and get the right "base address" for your desired value. (Careful: CheatEngine might inject in foreign processes and might be detected)

Infos and how to:

https://en.wikipedia.org/wiki/Cheat_Engine

https://www.wikihow.com/Use-Cheat-Engine

If you keep learning memory structure, mapping, PE header, etc. you will be able find a way to automate the process of getting the right base address upon each start. (until a new build/patch has been made)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.