Cheat Engine

[Vanapapi]

Hi, I'm in a little trouble with multi-level pointers, as beginners tend to be.
Now my purpose is to read the value of the adress which has multiple pointers to it, here is the CE result:
epvpimg . com/n8Vgh
And I'm kinda confused with 2 things:
1)I'm using multiple ReadProccessMemory() functions, and I should start it from the bottom adress to the upper right?
2)Should I start with "Game.exe"+0x01D74230 and if I do, how? Or 0x10E62A30?

Here is my current code:

[lucidity]

I definitely have to recommend moving those pointers into an array so you don't have a ton of redundant code.

Make a general process to read the pointers, so you can read a pointer value regardless of how many levels you must traverse.

With regards to your questions:
1) Yes
Game.exe + 1D74230 = 10E62A30
Result +58
Result +98
...etc...

2) You can dynamically calculate the address (get game.exe base, then add the base offset). You can also use 10E62A30 as you are, but it will only work for a short time because the address is not relative to the base. This means you will need to calculate and reenter this address every time you reload the program. It might be simpler to get it working as-is first and then work on getting the base address dynamically after it is working.

What is the problem with the program? What output do you receive? Have you made any attempts at debugging it? Have you ruled anything out?

[Vanapapi]

[Dark Byte]

Just wondering, did you make up those addresses or are they real addresses?

e.g: There is no way that "Game.exe"+0x01D74230 equals 0x10E62A30 (it's not even on a page boundary) , so check that first

[lucidity]

Nice catch DB, you're awesome.

OP, my C++ is not that great, and I haven't tested this, but a simplified version of your script might look like this... note the number "5" does not exist and offsets.size() is used instead. This means if you have more or less offsets, the FindPointerAddr function will still work:

[Vanapapi]

@Dark Byte
If it's "AOgame.exe" does it make any difference? Because I didn't make them up.
Here is another picture with another adresses, but "AOgame.exe"+01D7423C and offsets are the same: http://epvpimg.com/9chhh



@lucidity
Your code doesn't work.
I ran into exact same problems when I tried to make it with arrays. (line 9 and 11)

[lucidity]

What DB is saying is that your game.exe value cannot be 0x10E62A30 - 0x01D74230, or F0EE800. Though I don't understand what a page boundary is exactly, my interpretation is that F0EE800 should factor evenly into a number which it does not.

You can see the real game.exe base in CE by attaching to game.exe and adding an address of game.exe (type that instead of an address). CE will interpret game.exe and show the address in the list as the base. That address won't be F0EE800 according to DB (I definitely believe him).

This modified code should work (created a size variable before the for loop):

[Dark Byte]

10db3ec0 is a dynamic address that is pointed to by game.exe+1d7423c, so that means you must first read the 4 byte address at game.exe+1d7423c

Most likely, it is 0217423c, but it's recommended to get the base address if it shifts on each run

[lucidity]

[Vanapapi]

@Dark Byte
You were right and now it works. Amazing, how did you know the adress without even knowing the actual game? Any easy way I've missed out?
I got it by scanning for the value that "AOgam+exe"+01D74230 created.

@lucidity
Thank you for the code, the

[lucidity]

right

[shakib187]

How would this be different in x64 processes? I tried uint64_t already but it didnt do anything for me

[Dark Byte]

Uint64's are 8 byte