Alright, so you're trying to find the Red, Green, and Blue values of the currently selected color. I'll show you how to do this using Cheat Engine, but you can also translate this to x64dbg.
Fire up Paint and select mspaint.exe in CE(Cheat Engine) to debug it.
Set the color to black or any other color you'd like, I will use black as my initial starting color. See what RGB values the color black has in Paint, in our case it's 0 0 0.
1
Here I will make a few assumptions. I will assume that the Red, Green and Blue values are each 1 byte in size because they can only go up to 255 which is the limit that a 1 byte value can hold. I also assume that these values are at the same address, one after the other. Equivalent to
struct color {
char r, g, b;
}
To sum it up, we want to find 3 contiguous byte values somewhere in memory. We know their values from Paint, so we can search for them.
So, now we can switch over to CE and select Grouped scan so we can search for grouped values. In our case we have a group of 3 values, each being 1 byte. So, this is how CE should now look like.
1
Then I simply press on First Scan and CE will find any memory in the paint.exe address space where there are 3 bytes with 0 in them, equivalent to
someAddress 0x00
someAddress+1 0x00
someAddress+2 0x00
CE will find a lot of addresses where this byte pattern occurs because three zero bytes isn't very unique.
What I will do now is select another color in Paint and follow the same process, except at the end I'll press Next Scan instead of First Scan. What this will do is CE will look at all of the addresses it found with three zeroes, and it will look if any of them changed to your new grouped values. One of those addresses will now hold the three new grouped values, and CE will find it for you and you'll only be left with hopefully one address left. If you're left more than a few, you can repeat the process with a new color.
If the address is color in Green, it means that it is static and will not change when you restart paint. Once you have the address of where the RGB is stored, and you can change it or read it or do whatever you want with it.
