Question

I am using a readprocessmemory class and have got it to work for reading through multilevel pointers and displaying the integer at the final address in label2.text.

This works where I specify the base address, (shown as “0x40000” below):

private void label2_Click(object sender, EventArgs e)
    {
        int Readpointer = Trainer.ReadPointerInteger("runningprocess", 0x40000, new int[3] { 0x3, 0x4, 0x10 });
        string converted = Readpointer.ToString();
        label2.Text = converted;

Now instead of specifying the base address “40000”, I wanted to use a function to ‘find out’ the base address of the process and store it in a variable and pass that as a paramater instead. This does the first part:

        Process[] test = Process.GetProcessesByName("runningprocess"); //Get process base address
        int Base = test[0].MainModule.BaseAddress.ToInt32(); // ""

Unfortunately, the "Trainer.ReadPointerInteger" function requires the baseaddress paramater in the form “0x40000”. So I did this:

        string BaseAddress = "0x" + Addr.ToHex(Base); // addr.ToHex is just another function which converts the int to hex.

Now at the point I want to pass the variable to ReadPointerInteger's second paramater, and I tried this:

        int Readpointer = Trainer.ReadPointerInteger("runningprocess", BaseAddress, new int[3] { 0x3, 0x4, 0x10 });
        string converted = Readpointer.ToString();
        label2.Text = converted;

It looks like this should work, but the problem (error) is that the second parameter of the ‘Trainer’ function is an Int, which to my newbie eyes is weird as it isn’t intuitive to me to have an input parameter which includes letters as an Int. Anyway, I am stuck here, and wonder if someone could point out how to get around the Int/String problem?

FYI, the ReadPointerInteger class is:

public static int ReadPointerInteger(string EXENAME, int Pointer, int[] Offset)
{
    int Value = 0;
    checked
    {
        try
        {
            Process[] Proc = Process.GetProcessesByName(EXENAME);
            if (Proc.Length != 0)
            {
                int Bytes = 0;
                int Handle = OpenProcess(PROCESS_ALL_ACCESS, 0, Proc[0].Id);
                if (Handle != 0)
                {
                    foreach (int i in Offset)
                    {
                        ReadProcessMemoryInteger((int)Handle, Pointer, ref Pointer, 4, ref Bytes);
                        Pointer += i;
                    }
                    ReadProcessMemoryInteger((int)Handle, Pointer, ref Value, 4, ref Bytes);
                    CloseHandle(Handle);
                }
            }
        }
        catch
        { }
    }
    return Value;
}

Answer 1

0x40000 is just another name for the integer 262144. It’s not a string with “0x” in it, it’s an alternative syntax for writing integers, for use when base 16 is more enlightening than base 10. In particular, the following cannot be true:

the “Trainer.ReadPointerInteger” function requires the baseaddress parameter in the form “0x40000”.

It’s just that addresses are usually written in hex.