# How would I find a color's memory address? (Beginner)

I'm an absolute beginner (just started learning about process memory a few hours ago).

I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg.

I know it's black, so I've tried searching for 000000, 0, 0, 0, Color 1, and Black in each of the boxes. (ASCII, UNICODE, Hex)

I've gotten nowhere with that. Like I said, I'm a beginner, so this is all extremely foreign to me.

I'd really appreciate some help with learning how to find a color's memory address, so I can then change the color and stuff.

Alright, so you're trying to find the Red, Green, and Blue values of the currently selected color. I'll show you how to do this using Cheat Engine, but you can also translate this to x64dbg.

Fire up Paint and select `mspaint.exe` in CE(Cheat Engine) to debug it.

Set the color to black or any other color you'd like, I will use black as my initial starting color. See what RGB values the color black has in Paint, in our case it's 0 0 0.

1

Here I will make a few assumptions. I will assume that the Red, Green and Blue values are each 1 byte in size because they can only go up to 255 which is the limit that a 1 byte value can hold. I also assume that these values are at the same address, one after the other. Equivalent to

``````struct color {
char r, g, b;
}
``````

To sum it up, we want to find 3 contiguous byte values somewhere in memory. We know their values from Paint, so we can search for them.

So, now we can switch over to CE and select `Grouped` scan so we can search for grouped values. In our case we have a group of 3 values, each being 1 byte. So, this is how CE should now look like.

1

Then I simply press on `First Scan` and CE will find any memory in the paint.exe address space where there are 3 bytes with 0 in them, equivalent to

``````someAddress   0x00
What I will do now is select another color in Paint and follow the same process, except at the end I'll press `Next Scan` instead of `First Scan`. What this will do is CE will look at all of the addresses it found with three zeroes, and it will look if any of them changed to your new grouped values. One of those addresses will now hold the three new grouped values, and CE will find it for you and you'll only be left with hopefully one address left. If you're left more than a few, you can repeat the process with a new color.
• @Albertay learn some basic assembly by reading an assembly book, just google for recommendations on SO. I'd also highly recommend `Computer systems : a programmer's perspective` and read reddit.com/r/ReverseEngineering/comments/12ajwc/… Aug 19, 2016 at 0:39