Question

I am trying to read memory from an process in C#. I found out how to read from an specific address:

    public static byte[] ReadMemory(Process process, int address, int numOfBytes, out int bytesRead)
    {
        IntPtr hProc = OpenProcess(ProcessAccessFlags.All, false, process.Id);
        byte[] buffer = new byte[numOfBytes];
        ReadProcessMemory(hProc, new IntPtr(address), buffer, numOfBytes, out bytesRead);
        return buffer;
    }
    private int getVal(Process proc, int address)
    {
        int bytesRead;
        byte[] value = ReadMemory(proc, address, 4, out bytesRead);
        int am = BitConverter.ToInt32(value, 0);
        return am;
    }
    public void threadFunction()
    {
        Process[] processes = Process.GetProcessesByName("gta_sa");
        foreach (Process process in processes)
        {
            int ServerPointer = getVal(process, 0xB6F5F0);//Its about this line
            MessageBox.Show(ServerPointer.ToString());
        }
    }

but as I am looking trough the web, I keep finding this:

But instead of 0xB6F5F0 I actually need to read address samp.dll+2071C0 (this address I found on the web)

Does anyone know how I can do this?

Thanks in advance

Answer 1

You need to know the base address of the DLL. That’s readily available through Process.Modules, you want the ProcessModule.BaseAddress property value. An example:

using System;
using System.Diagnostics;

class Program {
    static void Main(string[] args) {
        var prc = Process.Start("notepad.exe");
        prc.WaitForInputIdle();
        foreach (ProcessModule module in prc.Modules) {
            if (string.Compare(module.ModuleName, "user32.dll", true) == 0) {
                Console.WriteLine("User32 loaded at 0x{0:X16}", (long)module.BaseAddress);
                break;
            }
        }
        prc.Kill();
        Console.ReadLine();
    }
}

Output:

User32 loaded at 0x0000000076F20000