2

Why the module address is different in Cheat Engine than in x32dbg?

enter image description here

I'm trying to read this:

enter image description here

My c++ attempt:

#include "pch.h"
#include "Functions.h"
#include "offsets.h"
#include <iostream>

using namespace std;

DWORD WINAPI HackThread(HMODULE hModule)
{
    //Create Console
    AllocConsole();
    FILE* f;
    freopen_s(&f, "CONOUT$", "w", stdout);

    cout << "We're injected!\n";

    uintptr_t module = (uintptr_t)GetModuleHandle(NULL);        
    int addr = module + 0x04939F0;

    while (true)
    {
        if (GetAsyncKeyState(VK_END) & 1)
        {
            cout << "Reading: " << hex << addr << endl;
            cout << *(int*)addr << endl;
        }

        Sleep(5);
    }

    fclose(f);
    FreeConsole();
    FreeLibraryAndExitThread(hModule, 0);
    return 0;
}

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CloseHandle(CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)HackThread, hModule, 0, nullptr));
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

From c++ I can find this module address:

enter image description here

I'm not sure if I was reading the correct address my code will work...

3
  • 905a4d is MZ dos Header and is not an address ; your code paste and result paste seems to differ the code does not have the string "Setting xxxxx" ; Read About ASLR the Address Will always be different in each run of executable because of Address Space Layout Randomization in os > vista
    – blabb
    Jun 22 at 19:49
  • updated image, "RealestaDX9.exe" is pointing to 0x905A4D in every run of executable Jun 22 at 20:34
  • yes that is right realxxxxx is an address (start of executable ) it points to DosHeader->Signature MZ (0x4D 0x5A 0x90 0x00) in little endian as 0x00905a4d what do you expect ?
    – blabb
    Jun 22 at 20:58
-1

I just had to derreference 0xB20000:

enter image description here

1
  • 2
    Please don't post terminal text as screenshot. Instead copy the text and paste it using code-formatting.
    – Robert
    Jun 23 at 14:39

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .