Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


how to search for text

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
thedebutent
Newbie cheater
Reputation: 0

Joined: 30 Dec 2015
Posts: 11

PostPosted: Wed Dec 30, 2015 12:29 am    Post subject: how to search for text Reply with quote

hello,
I want to know how to search a text with the value in vb.net?
thanks for your help
Here image below:



cheat.jpg
 Description:
the red arrow that the little value
 Filesize:  176.04 KB
 Viewed:  14710 Time(s)

cheat.jpg


Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Wed Dec 30, 2015 12:37 am    Post subject: Reply with quote

As you can see in your own screenshot, text is nothing more than an array of bytes.
76 00 61 00 75 00 6C 00 etc...
The text in your example is in a unicode format, hence the extra 00 bytes.
Simply convert your string into an array of bytes and use the various search methods provided all over this site and others.
Back to top
View user's profile Send private message
thedebutent
Newbie cheater
Reputation: 0

Joined: 30 Dec 2015
Posts: 11

PostPosted: Wed Dec 30, 2015 2:54 am    Post subject: Reply with quote

here is my code:

[Public Class Form1
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As Integer
Private Declare Function ReadProcessMemory4 Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Byte, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Byte

Public Function FindPattern(ByVal Process As String, ByVal Pattern As Byte(), ByVal Mask As String) As Long
For dwCurrentAddress As Long = &H10000 To &H7FFFFFF Step &H1
If Compare(Process, dwCurrentAddress, Pattern, Mask) Then
Return dwCurrentAddress
End If
Next
Return -1
End Function
Public Function Compare(ByVal Process As String, ByVal Address As Long, ByVal Pattern As Byte(), ByVal Mask As String) As Boolean
Dim pTemp As Byte = Nothing
For i As Integer = 0 To Mask.Length - 1 Step 1
pTemp = ReadByte(Process, (Address + i), 4)
If pTemp = Nothing Then
Return False
End If
If Mask(i) = "x" And pTemp <> Pattern(i) Then
Return False
End If
Next
Return True
End Function

Public Function ReadByte(ByVal ProcessName As String, ByVal Address As Integer, Optional ByVal nsize As Integer = 4) As Byte
If ProcessName.EndsWith(".exe") Then
ProcessName = ProcessName.Replace(".exe", "")
End If
Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
If MyP.Length = 0 Then
MessageBox.Show(ProcessName & " isn't open!")
Exit Function
End If
Dim hProcess As IntPtr = OpenProcess(&H10, 0, MyP(0).Id)
If hProcess = IntPtr.Zero Then
MessageBox.Show("Failed to open " & ProcessName & "!")
Exit Function
End If
Dim hAddress As Integer
Dim vBuffer As Byte = Nothing

hAddress = Address
ReadProcessMemory4(hProcess, hAddress, vBuffer, nsize, 0)

Return vBuffer
End Function


Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
Dim Pattern As Byte() = Array.ConvertAll("76 00 61 00 75 00 6C 00 74 00 4C 00 65 00 76 00 65 00 6C 00 39 00 31".ToCharArray(), Function(c) CType(Asc(c), Byte))
Dim MonAddress As Long = FindPattern("Template.exe", Pattern, "xxxxxxxxxxxxxxxxxxxxxxx")
TextBox1.Text = MonAddress => no found

End Sub]
Did you find another solution faster for bytes "76 00 61 00 75 00 6C 00 74 00 4C 00 65 00 76 00 65 00 6C 00 39 00 31"?
Thank you beforehand[/code]
Back to top
View user's profile Send private message
thedebutent
Newbie cheater
Reputation: 0

Joined: 30 Dec 2015
Posts: 11

PostPosted: Fri Jan 01, 2016 2:51 am    Post subject: Reply with quote

here is my code that works address :
Code:
Public Class Form1
    Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Int32, ByVal bInheritHandle As Int32, ByVal dwProcessId As Int32) As Int32
    Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Int32, ByVal lpBaseAddress As Int32, ByRef lpBuffer As Int32, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Int32
    Private Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Int32, ByVal lpBaseAddress As Int32, ByRef lpBuffer As Int32, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Int32
    Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Int32) As Int32
    Public Const PROCESS_VM_READ = &H10
    Public Const PROCESS_VM_WRITE = (&H20)
    Public Const PROCESS_VM_OPERATION = (&H8)
    Public Const PROCESS_QUERY_INFORMATION = (&H400)
    Public Const PROCESS_READ_WRITE_QUERY = PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_VM_OPERATION + PROCESS_QUERY_INFORMATION
    Public Const PROCESS_ALL_ACCESS = &H1F0FFF
    Public Function Tibia_Hwnd() As Long
        Dim TibiaWindows As Process() = Process.GetProcessesByName("Template")
        If TibiaWindows.Length = 0 Then
            Return 0
            Exit Function
        End If
        Return TibiaWindows(0).Id
    End Function

    Private Function Memory_ReadLong(ByVal Address As Int32) As Long
        Dim vBuffer As Long
        Dim processHandle As IntPtr = OpenProcess(PROCESS_VM_READ, 0, Tibia_Hwnd)
        ReadProcessMemory(processHandle, Address, vBuffer, 4, 0)
        Return vBuffer
        CloseHandle(processHandle)
    End Function

    Private Function Memory_WriteLong(ByVal Address As Int32, ByVal vBuffer As Long) As Long
        Dim processHandle As IntPtr = OpenProcess(PROCESS_READ_WRITE_QUERY, 0, Tibia_Hwnd)
        WriteProcessMemory(processHandle, Address, vBuffer, 4, 0)
        Return vBuffer
        CloseHandle(processHandle)
    End Function

    Public Function Memory_ReadString(ByVal Address As Long, ByVal CharCount As Int32) As String
        Dim ret As Byte() = Nothing
        Dim vBuffer As Long

        Dim processHandle As IntPtr = OpenProcess(PROCESS_VM_READ, 0, Tibia_Hwnd)
        Dim tStr(CharCount) As Char
        Dim retStr As String = ""
        For i As Int32 = 0 To CharCount Step 2
            ReadProcessMemory(processHandle, Address + i, vBuffer, 1, 0)
            ret = BitConverter.GetBytes(vBuffer)
            tStr(i) = System.Text.Encoding.Unicode.GetString(ret) : retStr += tStr(i)

        Next i
        Return retStr
        CloseHandle(processHandle)
    End Function

    Public Function WriteString(ByVal address As Long, ByVal str As String) As Boolean
        Dim processHandle As IntPtr = OpenProcess(PROCESS_READ_WRITE_QUERY, 0, Tibia_Hwnd)
        For i As Integer = 0 To Len(str) - 1
            WriteProcessMemory(processHandle, address + i, Asc(Mid(str, i + 1, 1)), 1, 0)
        Next i
        Return 0
    End Function
   
    Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
        TextBox1.Text = Memory_ReadString(&H34B94F4, 23).ToString
    End Sub
End Class


the address & H34B94F4 is the position of my word unicode.
how to find the address in relation to my word (eg "vaultLevel91")?
do you have a way to display the address in relation to the word?
thank you beforehand
Back to top
View user's profile Send private message
pkedpker
Master Cheater
Reputation: 1

Joined: 11 Oct 2006
Posts: 412

PostPosted: Fri Jan 01, 2016 2:56 pm    Post subject: Reply with quote

Code:

Encoding.Unicode.GetString(packet, startIndex, size)


in your case
Code:

dim vBuffer() as byte
dim YourString as String = Encoding.Unicode.GetString(vBuffer, 0, CharCount)


your Memory_ReadString method could be made better and it would be faster too.
If it doesn't work try changing
Code:
ReDim vBuffer(CharCount * 2)

to
Code:
ReDim vBuffer((CharCount * 2)+1)


Code:

    Public Function Memory_ReadString(ByVal Address As Long, ByVal CharCount As Int32) As String
        Dim ret As Byte() = Nothing
        Dim vBuffer As Byte()
        ReDim vBuffer(CharCount * 2)

        Dim processHandle As IntPtr = OpenProcess(PROCESS_VM_READ, 0, Tibia_Hwnd)
        ReadProcessMemory(processHandle, Address, vBuffer, CharCount*2, 0)
        CloseHandle(processHandle)
        Return Encoding.Unicode.GetString(vBuffer, 0, CharCount)
    End Function


I use *2 because it contains zeros between of every letter for unicode.. make sure first letter isn't a zero or it will give you chinese letters lol.

The ReDim +1 i don't know if it's necessary probably not, Since I don't know how ReadProcessMemory from the top of my head it might be needed but most likely not.


Edit:

I fix your WriteString too.. now its better and much faster (assuming WriteString also must be unicode not ASCII.. if it's ASCII then it's a easy fix just change one line of code

ASCII:
Code:
Dim bytes() As Byte = System.Text.Encoding.ASCII.GetBytes(str)

UNICODE:
Code:
Dim bytes() As Byte = Encoding.Unicode.GetBytes(str)


Code:

   Public Sub WriteString(ByVal address As Long, ByVal str As String)
        Dim processHandle As IntPtr = OpenProcess(PROCESS_READ_WRITE_QUERY, 0, Tibia_Hwnd)

      Dim bytes() As Byte = System.Text.Encoding.Unicode.GetBytes(str)
      WriteProcessMemory(processHandle, address ,bytes, bytes.Length, 0)
    End Sub


You'll probably need both ASCII and UNICODE for certain situations.. so I would make a if statement to hop between both of them with a extra parameter to WriteString determining if its UNICODE or ASCII

Here I show you

Code:

   Public Sub WriteString(ByVal address As Long, ByVal str As String, isASCII as Boolean) As Boolean
        Dim processHandle As IntPtr = OpenProcess(PROCESS_READ_WRITE_QUERY, 0, Tibia_Hwnd)

      Dim bytes() As Byte
      if isASCII then
          bytes = System.Text.Encoding.ASCII.GetBytes(str)
      else
          bytes = System.Text.Encoding.Unicode.GetBytes(str)
      end if
      WriteProcessMemory(processHandle, address ,bytes, bytes.Length, 0)
    End Sub


The WriteProcessMemory length is also calculated using the text encoding as it always returns the right sizes.

_________________
Hacks I made for kongregate.
Kongregate Universal Badge Hack: http://forum.cheatengine.org/viewtopic.php?p=4129411
Kongreate Auto Rating/Voter hack: http://forum.cheatengine.org/viewtopic.php?t=263576
Took a test lol
Back to top
View user's profile Send private message
thedebutent
Newbie cheater
Reputation: 0

Joined: 30 Dec 2015
Posts: 11

PostPosted: Sun Jan 03, 2016 2:35 am    Post subject: Reply with quote

hello,
here is my code change:
Code:
Public Class Form1
    Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As Integer
    Private Declare Function ReadProcessMemory4 Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Byte, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Byte

    Public Function FindPattern(ByVal Process As String, ByVal HEXA As String) As Long
        For dwCurrentAddress As Long = &H1000000 To &H7FFFFFFF Step 1
            If Compare(Process, dwCurrentAddress, HEXA) Then
                Return dwCurrentAddress
            End If
        Next
        Return -1
    End Function

    Private Function Compare(Process As String, Address As Long, HEXA As String) As Boolean
        Dim pTemp As Byte = Nothing
        For i As Integer = 0 To HEXA.Length - 1 Step 1
            pTemp = ReadByte(Process, (Address + i), 4)
            If pTemp = Nothing Then
                Return False
            End If
        Next
        Return True
    End Function
    Public Function ReadByte(ByVal ProcessName As String, ByVal Address As Integer, Optional ByVal nsize As Integer = 4) As Byte
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
        End If
        Dim hProcess As IntPtr = OpenProcess(&H10, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
        End If
        Dim hAddress As Integer
        Dim vBuffer As Byte = Nothing

        hAddress = Address
        ReadProcessMemory4(hProcess, hAddress, vBuffer, nsize, 0)

        Return vBuffer
    End Function


    Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
        Dim HEXA As String = "54 3D 6A 10 00 24 B9 03 8C 48 C9 03 5A 00 00 00"
        Dim MonAddress As Long = FindPattern("Template", HEXA)
        TextBox1.Text = MonAddress.ToString("X8")
    End Sub


with my code change how having same address as the cheat engine?
Thanks for your help?



Search.jpg
 Description:
 Filesize:  116.6 KB
 Viewed:  14575 Time(s)

Search.jpg


Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites