Aion Game.DLL

01/14/2013 06:40 XanOwnS#1
Why does game.dll address change when Aion is loaded into Sandboxie?
and how can I account for this when reading at game.dll + Offset?

Please someone enlighten me.
01/14/2013 07:07 lucid#2
The base address of Game.dll is determined at runtime, that is why it changes.

You can programmatically determine the base address by checking the [Only registered and activated users can see links. Click Here To Register...].
01/14/2013 22:12 buFFy!#3
This might help you.
Taken from my Pattern Scanner, you will have to adjust it.

Code:
	boolean InitiateScanner()
	{
		this->hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, this->dwProcessId);
		if( this->hProcess == NULL )
			return false;

		MODULEINFO moduleInfo;
		MODULEENTRY32 modEntry = { sizeof(MODULEENTRY32) };
		HANDLE TH32S = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, this->dwProcessId);
		if( TH32S == NULL )
			return false;

		Module32First(TH32S, &modEntry);
		do
		{
			char buffer[100];
			wcstombs(buffer, modEntry.szModule, 100);
			if(!strcmp(buffer, szModule))
			{
				if(GetModuleInformation(this->hProcess, modEntry.hModule, &moduleInfo, sizeof(moduleInfo) ))
				{
					this->dwModuleEntry = (DWORD)moduleInfo.EntryPoint;
					this->dwModuleSize = (DWORD)moduleInfo.SizeOfImage;
					this->dwModuleBase = (DWORD)moduleInfo.lpBaseOfDll;
					return true;
				}
				return false;
			}
			modEntry.dwSize = sizeof(MODULEENTRY32);
		} while ( Module32Next(TH32S, &modEntry) );

		return false;
	}