Getting the correct memory address for a specific value

Question

I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was able to easily find where he had been working previously. https://www.youtube.com/watch?v=BHYjxsDROn4&t=8s

I am also trying to grab specific memory addresses and write a basic program that allows me to change them by writing to them externally, but every time I try to do it the memory address changes. I realize that memory is dynamic and this is supposed to happen, but I don't understand why it was not happening to him. Is it just because it is an older video and that's how it used to work, or am I missing something. In addition, in order to do it now I assume I need to somehow get the offset from the base address. Every video I watch about doing this refers to finding an offset for a pointer. Do only pointers maintain a static offset? If so, how do I find this in ollydbg?

Answer 1

Your your post contains multiple questions, I recommend separating them, and providing more details to them. My answer will be vague for this reason.

About the unchanging memory addresses, I assume what you are looking for is ASLR. Read this and this on the subject. As far as I know, you could use EMET or patch the executable directly to disable ASLR, thus the addresses wont change.

Alternatively, you could use other techniques to find your address, even if its changing.

As for offsets, they are usually added to a static address, to it to access the objects field/property. The specific addresses and offsets obviously depends on what you are trying to do, and should be acquired from your executable, by observing it in a debugger.

For example:

• Lets assume that you found that the game has a player object in the memory (the location might change on every run).

• Lets say that you found a static pointer an instance of the player object called "pPlayer", at this memory address: 0xAB1234.

• Lets also say that you know (because you reverse engineered the objects structure) that the player objects has a field containing the health points of your in-game character, stored as an integer, at the 0x16 offset.

• By adding the found offset to the player object address (base address of the object), you will get the memory address containing the character's current HP. And you could read it like this externally in your program or Cheat Engine: [[0xAB1234]+0x16]. In pseudo code it means that:

  AddressOfPlayerObject = memory.Read(0xAB1234)

  AddressOfHP = AddressOfPlayerObject + 0x16

  PlayerHP = memory.Read(AddressOfHP)

Answer 2

The reason his memory addresses weren't changing in that scenario is because the game is 32-bit and loaded into memory conventionally per this and this (do a CTRL + F for 0x400000 and read the paragraph the first 2 results are located in).

You may also see addresses referenced by a symbol name, like ac_client.exe+5B2C0, where ac_client.exe references a base of 0x400000 plus the offset 0x5B2C0.

As for what you're trying to accomplish in C++, there are Windows functions you can use to identify a process and then acquire its base address. Then you can base offsets off that. If your addresses are changing every time you start the game, then as Dominik suggested, ASLR may be what you're dealing with. Or an anti-cheat/obfuscation implementation like Denuvo. Or a game utilizing something like JVM which can change addresses and sub-routine instructions with each restart.

Your options are commonly to reference a symbol name, find a base address + offset to reference, or identify a byte signature (aka "array of bytes") you can scan for--of which you then acquire an address to use either in and of itself, or as a reference point to base an offset from.

There's a lot more to all of this, but I highly recommend you pick up the book "Game Hacking". For what you're looking to do, it will impart quite a bit of wisdom to you that you'd otherwise spend hours upon hours trying to piece together via posts and videos. It also provides code snippets you need for things like acquiring the PID of a running process, etc.