2

Why the module address is different in Cheat Engine than in x32dbg?

enter image description here

I'm trying to read this:

enter image description here

My c++ attempt:

#include "pch.h"
#include "Functions.h"
#include "offsets.h"
#include <iostream>

using namespace std;

DWORD WINAPI HackThread(HMODULE hModule)
{
    //Create Console
    AllocConsole();
    FILE* f;
    freopen_s(&f, "CONOUT$", "w", stdout);

    cout << "We're injected!\n";

    uintptr_t module = (uintptr_t)GetModuleHandle(NULL);        
    int addr = module + 0x04939F0;

    while (true)
    {
        if (GetAsyncKeyState(VK_END) & 1)
        {
            cout << "Reading: " << hex << addr << endl;
            cout << *(int*)addr << endl;
        }

        Sleep(5);
    }

    fclose(f);
    FreeConsole();
    FreeLibraryAndExitThread(hModule, 0);
    return 0;
}

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CloseHandle(CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)HackThread, hModule, 0, nullptr));
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

From c++ I can find this module address:

enter image description here

I'm not sure if I was reading the correct address my code will work...

3
  • 905a4d is MZ dos Header and is not an address ; your code paste and result paste seems to differ the code does not have the string "Setting xxxxx" ; Read About ASLR the Address Will always be different in each run of executable because of Address Space Layout Randomization in os > vista
    – blabb
    Commented Jun 22, 2021 at 19:49
  • updated image, "RealestaDX9.exe" is pointing to 0x905A4D in every run of executable Commented Jun 22, 2021 at 20:34
  • yes that is right realxxxxx is an address (start of executable ) it points to DosHeader->Signature MZ (0x4D 0x5A 0x90 0x00) in little endian as 0x00905a4d what do you expect ?
    – blabb
    Commented Jun 22, 2021 at 20:58

1 Answer 1

-1

I just had to derreference 0xB20000:

enter image description here

1
  • 2
    Please don't post terminal text as screenshot. Instead copy the text and paste it using code-formatting.
    – Robert
    Commented Jun 23, 2021 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.