1

I'm an absolute beginner (just started learning about process memory a few hours ago).

I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg.

I know it's black, so I've tried searching for 000000, 0, 0, 0, Color 1, and Black in each of the boxes. (ASCII, UNICODE, Hex)

I've gotten nowhere with that. Like I said, I'm a beginner, so this is all extremely foreign to me.

I'd really appreciate some help with learning how to find a color's memory address, so I can then change the color and stuff.

2

Alright, so you're trying to find the Red, Green, and Blue values of the currently selected color. I'll show you how to do this using Cheat Engine, but you can also translate this to x64dbg.

Fire up Paint and select mspaint.exe in CE(Cheat Engine) to debug it.

Set the color to black or any other color you'd like, I will use black as my initial starting color. See what RGB values the color black has in Paint, in our case it's 0 0 0.

1enter image description here

Here I will make a few assumptions. I will assume that the Red, Green and Blue values are each 1 byte in size because they can only go up to 255 which is the limit that a 1 byte value can hold. I also assume that these values are at the same address, one after the other. Equivalent to

struct color {
    char r, g, b;
}

To sum it up, we want to find 3 contiguous byte values somewhere in memory. We know their values from Paint, so we can search for them.

So, now we can switch over to CE and select Grouped scan so we can search for grouped values. In our case we have a group of 3 values, each being 1 byte. So, this is how CE should now look like.

1enter image description here

Then I simply press on First Scan and CE will find any memory in the paint.exe address space where there are 3 bytes with 0 in them, equivalent to

someAddress   0x00
someAddress+1 0x00
someAddress+2 0x00

CE will find a lot of addresses where this byte pattern occurs because three zero bytes isn't very unique.

What I will do now is select another color in Paint and follow the same process, except at the end I'll press Next Scan instead of First Scan. What this will do is CE will look at all of the addresses it found with three zeroes, and it will look if any of them changed to your new grouped values. One of those addresses will now hold the three new grouped values, and CE will find it for you and you'll only be left with hopefully one address left. If you're left more than a few, you can repeat the process with a new color.

If the address is color in Green, it means that it is static and will not change when you restart paint. Once you have the address of where the RGB is stored, and you can change it or read it or do whatever you want with it.

  • I know this is a basic step-by-step, but OP sounds like he needs it. – Majiick Aug 19 '16 at 0:17
  • WOW! You really went the extra mile! Thank you VERY much for the extremely detailed answer. This helped me out a lot! – Albertay Aug 19 '16 at 0:31
  • @Albertay learn some basic assembly by reading an assembly book, just google for recommendations on SO. I'd also highly recommend Computer systems : a programmer's perspective and read reddit.com/r/ReverseEngineering/comments/12ajwc/… – Majiick Aug 19 '16 at 0:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.