[Question] VB.Net and process memory

07/27/2008 17:41 purplehaze#1

Hello, Im having some trouble with read/write process Memory and Im hoping someone here could help me out a little.

Code:

Code:

        Dim iMoneyAddress As Integer
        iMoneyAddress = 90720324
        Dim Reader As New MemReader.ProcessMemoryReader()
        Dim MyProcs As System.Diagnostics.Process() = System.Diagnostics.Process.GetProcessesByName("Conquer")

        If MyProcs.Length = 0 Then
            MessageBox.Show("No Conquer Client found!")
            Return
        End If
        Reader.ReadProcess = MyProcs(0)
        Reader.OpenProcess()
        Dim bytesRead As Integer
        Dim Memory As Byte()
        Dim iMoney As Integer

        Memory = Reader.ReadProcessMemory(iMoneyAddress, 1, bytesRead)
        iMoney = Memory(0)
        txtMoney.Text = iMoney.ToString()

now there must be something wrong with my code because it is supposed to read the memory address 90720324 (&H56BE7C) *tried both but both didnt succeed..*

So if anyone could provide me some help or a working sample in VB.Net it would be very appreciated :)

P.S dont look at my sloppy coding and if need further info just ask, the class just contains the declarations and such

07/27/2008 23:28 link#2

56BE7C => 5684860
5684844 => 90720324

56BE7C => 90720324?

Dim Memory As Byte()
|| Label for a Row of Bytes in Memory

Dim iMoney As Integer
|| Label for 4 Bytes in Memory

ReadProcessMemory(iMoneyAddress, 1, bytesRead)
|| Read 1 Byte at iMoneyAddress

iMoney = Memory(0)
|| mov al, [Memory]
|| mov BYTE ptr [iMoney], al
||
|| iMoney gets the first Byte at Address of Memory

1 BYTE = FF = 255
2 BYTE = FFFF = 65535
3 BYTE = FFFFFF = 16777215
4 BYTE = FFFFFFFF = 4294967295

Money : 288901 Currency
In Hex: 46885
First Byte: 133

1. Read more Bytes
2. Allocate more Bytes of Memory to iMoney

07/28/2008 00:45 purplehaze#3

Quote:

Originally Posted by link

56BE7C => 5684860
5684844 => 90720324

56BE7C => 90720324?

Dim Memory As Byte()
|| Label for a Row of Bytes in Memory

Dim iMoney As Integer
|| Label for 4 Bytes in Memory

ReadProcessMemory(iMoneyAddress, 1, bytesRead)
|| Read 1 Byte at iMoneyAddress

iMoney = Memory(0)
|| mov al, [Memory]
|| mov BYTE ptr [iMoney], al
||
|| iMoney gets the first Byte at Address of Memory

1 BYTE = FF = 255
2 BYTE = FFFF = 65535
3 BYTE = FFFFFF = 16777215
4 BYTE = FFFFFFFF = 4294967295

Money : 288901 Currency
In Hex: 46885
First Byte: 133

1. Read more Bytes
2. Allocate more Bytes of Memory to iMoney

I appreciate your help a lot, but I dont really understand it.
This table and such only confused me more.
Could you maybe explain it easier, i have no experience with Memory reading but im trying :)

This is what i understand I need to read 4 bytes apparently im reading 1 so how do I read 4? because changing that 1 to 4 doesnt work lol.
If you have the time please explain it :)
And if you have a code sample for VB.Net that would help me a lot!

Im really stuck at this for days lol

edit:

Is this what you meant:

Memory = Reader.ReadProcessMemory(iMoneyAddress, 4, bytesRead)
iMoney = Memory(0)
iMoney = Memory(1)
iMoney = Memory(2)
iMoney = Memory(3)

That returns a value of 255 so making progress here lol not quite right yet tho :p

07/28/2008 02:30 link#4

Quote:

56BE7C => 5684860
5684844 => 90720324

56BE7C => 90720324?

"address 90720324 (&H56BE7C) *tried both but both didnt succeed..*"
90720324 is not 56BE7C in hexa.

Quote:

Dim Memory As Byte()
|| Label for a Row of Bytes in Memory

Dim iMoney As Integer
|| Label for 4 Bytes in Memory

ReadProcessMemory(iMoneyAddress, 1, bytesRead)
|| Read 1 Byte at iMoneyAddress

iMoney = Memory(0)
|| mov al, [Memory]
|| mov BYTE ptr [iMoney], al
||
|| iMoney gets the first Byte at Address of Memory

1 BYTE = FF = 255
2 BYTE = FFFF = 65535
3 BYTE = FFFFFF = 16777215
4 BYTE = FFFFFFFF = 4294967295

Money : 288901 Currency
In Hex: 46885
First Byte: 133

Explanation of your mistake.

Quote:

1. Read more Bytes
2. Allocate more Bytes of Memory to iMoney

Solution.

Try to read 4 Bytes (I don't know if the money requires 4, 2 or 8 Bytes, try it yourself [288901 are 3 Bytes]) and parse Memory to 32bit (4 Bytes) Value.

07/28/2008 03:20 purplehaze#5

Quote:

Originally Posted by link

"address 90720324 (&H56BE7C) *tried both but both didnt succeed..*"
90720324 is not 56BE7C in hexa.

Explanation of your mistake.

Solution.

Try to read 4 Bytes (I don't know if the money requires 4, 2 or 8 Bytes, try it yourself [288901 are 3 Bytes]) and parse Memory to 32bit (4 Bytes) Value.

I think this is too deep for me, because i have absolutely no clue what you just said lol, so if i get this straight depending on the amount of money u have the amounts of bytes change, that i didnt know!
so if i have 1 mill money with me thats still 3? or 4?
See now im even more confused lol.
All i want is to retrieve a value from a specific address and well it will always change i mean you get more money and less, you get the point its not really something i can "set" so no matter how many.
And parsing memory to 4 bytes I have no clue how to do that, i got experience with VB.Net just not with this whole memory thing.

I just cant believe reading a value is this difficult to understand for me, it sounds so easy.
I dont want to give up on this and i really need some code example, I googled for forever and all i find is for VB6 and C# just not a complete sample for vb.net

About the 2 values, must have copied wrong 1 from ini file :)
All values stored in a ini file so when i can read a value i can experiment with more just need the base of this to work

I changed my code to this:

Code:

        Dim iMoneyAddress As Integer
        iMoneyAddress = 90720324
        Dim Reader As New ProcessMemoryReader()
        Dim MyProcs As System.Diagnostics.Process() = System.Diagnostics.Process.GetProcessesByName("Conquer")

        If MyProcs.Length = 0 Then
            MessageBox.Show("No Conquer Client found!")
            Return
        End If
        Reader.ReadProcess = MyProcs(0)
        Reader.OpenProcess()
        Dim bytesRead As Integer
        Dim Memory As Byte()
        Dim iMoney As Integer

        Memory = Reader.ReadProcessMemory(iMoneyAddress, 4, 4, bytesRead)
        iMoney = Memory(0)

        For i = 0 To Memory.Length - 1
            txtMoney.Text += Memory(i).ToString
        Next

But still not receiving the value i should get :p
I also changed my function for ReadProcessMemory for the size of the bytes
wich i have set to 4 :
Memory = Reader.ReadProcessMemory(iMoneyAddress, 4, 4, bytesRead)

Anyway thanks again for your help sorry im a pain in the ass, but i just dont get it lol

07/28/2008 14:33 link#6

4 Byte/32bit : 00000000 00000000 00000000 00000000

288901 : 00000000 00000100 01101000 10000101 (Since 3 is not a power of 2, it's 4 Byte)

Reading the first Byte/eight Bit : 10000101

Reading the next Bytes : 01101000, then 00000100

x (4 Byte) : 100b

x << 8

[x = 100 00000000b]

x (in first Byte) : 1101000b

x << 8

[x = 100 01101000 00000000b]

x (in first Byte) : 10000101b

[x = 100 01101000 10000101b]

Code:

	mov pp, 100b
	shl pp, 8
	mov BYTE ptr [pp], 1101000b
	shl pp, 8
	mov BYTE ptr [pp], 10000101b

Or with direct Memory Access:

Code:

	mov BYTE ptr [pp], 10000101b
	mov BYTE ptr [pp + 1], 1101000b
	mov BYTE ptr [pp + 2], 100b

You have to know, how to access directly the Bytes in VB :-)

Visualization:
Reversed in Memory, Value 288901 : 10000101 01101000 00000100 00000000

ReadProcessMemory, 4 Bytes.

Memory[0] = 10000101

Memory[1] = 01101000

Memory[3] = 00000100

Memory[4] = 00000000

Now put these Bytes with the principle FIFO in iMoney (Memory[0] in first Byte of iMoney, Memory[1] in second, etc.).