vb.net Multi-Level pointer diffrent result than the one in Cheat engine? help

05/22/2012 15:33 Dinospy#1
Hello,
Im trying to read a value of a multi-level pointer using Vb.net but my result in VB comes out much different than the one in CE. I have tried this same method on other games ( SaintsRowTheThird, Titan Quest, and Eden Eternal) and it works perfectly but not on Tera. The value is either something negative like (-621185984) or 0.

Code:
  
Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Integer) As Integer

    Public phandle As Integer
    Public gbaseid As Int32
    Public GAMEEXE As String = "Tera"
    Private m_hProcess As IntPtr = IntPtr.Zero
    Public Function ReadMemANdOffset()
        Dim TeraProcess As Process = Process.GetProcessesByName(GAMEEXE)(0)
        Dim TeraProcessMainIndex As Integer = 0


        For i = 0 To TeraProcess.Modules.Count - 1
            If TeraProcess.Modules.Item(i).ModuleName.ToLower = GAMEEXE Then
                TeraProcessMainIndex = i

                Exit For
            End If
        Next

        phandle = TeraProcess.Handle
        gbaseid = TeraProcess.Modules.Item(TeraProcessMainIndex).BaseAddress.ToInt32()

        Dim OFFSETS As String() = {"01716B5C", "29c", "724", "30", "c", "48"}
        Dim CurMem As Integer = 0
        Dim CurAdd As Integer = gbaseid

        For i As Integer = 0 To OFFSETS.Length - 1
            Dim CurOFFset As Int32 = Int32.Parse(OFFSETS(i), System.Globalization.NumberStyles.HexNumber)
            If i = 0 Then
                ReadProcessMemory(phandle, CurAdd + CurOFFset, CurMem, 4, 0)
            Else
                ReadProcessMemory(phandle, CurMem + CurOFFset, CurMem, 4, 0)
            End If
        Next
        Dim FinalResult As Integer = CurMem
        Return FinalResult

    End Function

Pointer For HP:

<Address>"TERA.exe"+01716B5C</Address>
<Offset>48</Offset>
<Offset>C</Offset>
<Offset>30</Offset>
<Offset>724</Offset>
<Offset>29C</Offset>


What am I doing wrong here?
Please advise, im stuck.
05/22/2012 23:18 qickly#2
What is your OS?
05/22/2012 23:55 Dinospy#3
Im running on Windows 7 64bit
05/23/2012 16:55 qickly#4
I found the problem... You can not read memory addresses on this way on windows vista or 7.
05/23/2012 19:40 Dinospy#5
Are you sure? Because it does work with some games just not tera. Is there another method that does work with win7?
05/24/2012 22:37 qickly#6
I do not know a way to code it for this Os's.
Maybe download VMWare and use a virtual machine for reading the process memory in Windows XP...
WriteProcessMemory is supported by all OS's included Vista and 7.
05/31/2012 12:24 P5yl0#7
wrong cause that are wrong offsets...

"TERA.exe"+Base Adress >> changes >> actual.. rev.1729

"TERA.exe"+01744E94
Pointer1=0x14
Pointer2=0x30
Pointer3=0xC
CurrentHP=0x48

so have fun searching the others..^^

if anyone has..Offsets for
-TargetName
-Gathering (gatherable object yes/no)

would help me a lot^^
ty

cya