KDMemory (AutoIt 32 & 64 Bit)

[KDeluxe]

Originally Posted by Chemist.Service

Edit: Wichtige Frage, funktioniert das überhaupt wenn ich den StaticCast (0x025BDB80) zu den Offsets hinzufüge. Im Grunde wird diese Adresse ja genau wie die andere auch auf die BaseAddress addiert....

Nein und nein. Die $weightOffsets werden immer auf den ausgelesenen Wert addiert, das "StaticOffset" wird allerdings vor dem Lesen addiert. Das ist auch schon dein erster Fehler. Dein zweiter Fehler ist, dass du dein Coding an der falschen Stelle hinzugefügt hast. Angesichts der Tatsache, dass mein Beispielscript bereits ein "StaticOffset" verwendet, welches du nur anpassen hättest müssen, sollte ein allgemeines Verständnis vorhanden sein.

Ich habe mein Beispielscript an deinen Daten entsprechend angepasst:

 Spoiler

;~ #AutoIt3Wrapper_UseX64=n ; 32 Bit application
#AutoIt3Wrapper_UseX64=y ; 64 Bit application

#RequireAdmin
#include "KDMemory.au3"

Const $processName = "MortalOnline.exe", $moduleName = $processName
Const $staticOffset = 0x025BDB80
Const $offsetsInventoryWeight[5] = [0x310, 0x1A0, 0x508, 0x8, 0x144]

$processId = ProcessExists($processName)
If $processId == 0 Then
    MsgBox(48, "Error", "'" & $processName & "' is not running!")
Else
    $handles = _KDMemory_OpenProcess($processId)
    If @error Then
        MsgBox(48, "Error", "Can't open '" & $processName & "'!" & @CRLF & "@error: " & @error)
    Else
        $baseAddress = _KDMemory_GetModuleBaseAddress($handles, $moduleName) + $staticOffset
        If @error Then
            MsgBox(48, "Error", "Can't get ModuleBaseAddress ('" & $moduleName & "')!" & @CRLF & "@error: " & @error & ", @extended: " & @extended)
        Else
            $inventoryWeight = _KDMemory_ReadProcessMemory($handles, $baseAddress, "DWORD", $offsets)
            If @error Then
                MsgBox(48, "Error", "Can't read memory!" & @CRLF & "@error: " & @error & ", @extended: " & @extended)
            Else
                MsgBox(64, "Info", "Address: " & $inventoryWeight[0] & @CRLF & "Value: " & $inventoryWeight[1])
            EndIf
        EndIf
        _KDMemory_CloseHandles($handles)
    EndIf
EndIf

Da dein Zielprozess ein 64 Bit Prozess ist kannst du keine 32 Bit Anwendung erstellen. Mit dieser könntest du nicht auf den gesamten Speicher zugreifen. Den entsprechenden Fehlercode gibt meine UDF auch aus ().

[LiveLong23]

Hi

I have problem with value of memory, i tryed to compile 64 bit 32 bit, run as admin nothing works, but this works only with _KDMemory_ReadProcessString(), if i put _KDMemory_ReadProcessMemory() i get error 15, extended 1. So i dont know if problem is in UDF or something else.

Code is in Spoiler

 Spoiler

#RequireAdmin
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Compression=4
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****

#include "KDMemory.au3"

;~ If @AutoItX64 == 0 Then
;~     MsgBox(48, "Error", "Unsupported system")
;~     Exit
;~ EndIf

; Cheat Engine (x64) Tutorial Step 6: Pointers: (PW=098712)
Dim $handles = 0, $address = 0, $tmpError = 0, $tmpData[2]
Const $processName = "AlefClient.exe", $moduleName = $processName
Const $baseOffset = 0x00a41300
Const $offsetsValue[5] = [0xca4, 0x5c, 0x24, 0x4, 0x72c]
;~ Const $offsetsValue[5] = [0x72c, 0x4, 0x24, 0x5c, 0xca4]

GUICreate("Example", 400, 400)
$lbl_Info = GUICtrlCreateLabel("Waiting for '" & $processName & "'...", 5, 5, 400, 400)

GUISetState()

While True
;~  Sleep()
    $msg = GUIGetMsg()
    Switch $msg
        Case -3 ; $GUI_EVENT_CLOSE
            Exit
    EndSwitch

    $processId = ProcessExists($processName)
    If $processId == 0 Then
        If IsArray($handles) Then
            _KDMemory_CloseHandles($handles)
            $handles = 0
            $address = 0

            GUICtrlSetData($lbl_Info, "Waiting for '" & $processName & "'...")
        EndIf
        ContinueLoop
    EndIf

    If $handles == 0 Then
        $handles = _KDMemory_OpenProcess($processId)
        If @error Then
            If MsgBox(52, "Error", "Can't open '" & $processName & "'!" & @CRLF & "@error: " & @error & @CRLF & @CRLF & "Continue?") == 6 Then
                $handles = 0
                ContinueLoop
            Else
                Exit
            EndIf
        EndIf
    EndIf

    If $address == 0 Then
        $address = _KDMemory_GetModuleBaseAddress($handles, $processName) + $baseOffset
        If @error Then
            If MsgBox(52, "Error", "Can't get ModuleBaseAddress '(" & $moduleName & ")'!" & @CRLF & "@error: " & @error & ", @extended: " & @extended & @CRLF & @CRLF & "Continue?") == 6 Then
                $address = 0
                ContinueLoop
            Else
                Exit
            EndIf
        EndIf
    EndIf

    $memoryData = _KDMemory_ReadProcessString($handles, $address, "DWORD", $offsetsValue)
    If @error Then
        If $tmpError <> @error Then
            $tmpError = @error
            GUICtrlSetData($lbl_Info, "Can't read memory!" & @CRLF & "@error: " & @error & ", @extended: " & @extended)
        EndIf
    Else
        If $tmpData[0] <> $memoryData[0] Or $tmpData[1] <> $memoryData[1] Then
            $tmpData = $memoryData
            GUICtrlSetData($lbl_Info, "Address: " & $memoryData[0] & @CRLF & "Value: " & $memoryData[1])
        EndIf
    EndIf
WEnd

[sitapea1337]

Any error documentation?
Getting error 12, extended 5
_KDMemory_GetModuleBaseAddress

[gοd]

Originally Posted by sitapea1337

Any error documentation?
Getting error 12, extended 5
_KDMemory_GetModuleBaseAddress

says the following:

ERROR_ACCESS_DENIED
    5 (0x5)
    Access is denied.

By looking at the UDF (line 385-391) the error is set when the call of returns an invalid handle.

Easiest solution would be to add '#RequireAdmin' at the start of your script, I guess?
(depending on the needed rights to access the process like that)

[sitapea1337]

Already done that, this is my script

Getting error when trying to read module base address.

The interesting part is - when I check with disassembler, addresses are 8-bytes, not 4-bytes and Gw2-64.exe base (checked with CE) is also 8-bytes long.

;~ #AutoIt3Wrapper_UseX64=n ; 32 Bit application
#AutoIt3Wrapper_UseX64=y ; 64 Bit application

#RequireAdmin
#include "KDMemory.au3"
#include <MsgBoxConstants.au3>
Global $windowname = "Guild Wars 2"
Global $process = "Gw2-64.exe"
Global $lootkey = "f"
Global $pbO1 = 0x01D4CD00 ; Player base offset 1 (process + offset)
Global $pbO2 = 0x28 ; Player base offset 2 (pbO1 + offset)
Global $lootO = 0x1D49EFB ; Loot info offset

If @AutoItX64 == 0 Then
    MsgBox(0, "Error", "AutoIt isn't running as x64!")
    Exit
EndIf

If not IsAdmin() Then
    MsgBox(0, "Error", "AutoIt doesn't have administrator rights!")
    Exit 0
EndIf

$pID = ProcessExists($process)
If $pID == 0 Then
    MsgBox(0,"Error","Process '" & $process &"' not running!",0)
    Exit 0
EndIf

$handle = _KDMemory_OpenProcess($pID)
If @error Then
    MsgBox(0,"Error","Error opening process!" & @CRLF & "@error: " & @error & ", @extended: " & @extended,0)
    Exit 0
EndIf

$pBase = _KDMemory_GetModuleBaseAddress($handle, $process)
If @error Then
    MsgBox(0,"Error","Error getting process base!" & @CRLF & "@error: " & @error & ", @extended: " & @extended,0)
    Exit 0
EndIf

[gοd]

Originally Posted by sitapea1337

Already done that, this is my script

Getting error when trying to read module base address.

The interesting part is - when I check with disassembler, addresses are 8-bytes, not 4-bytes and Gw2-64.exe base (checked with CE) is also 8-bytes long.
[..]

Nothing unusual for a x64 process which is using QWORDs.
--
As far as I can see there are no erros regarding your code. Is anything blocking the access, e.g. an antivirus? Does your process have any protection like by an anticheat?

[sitapea1337]

Guild Wars 2 shouldn't have anti-cheat system, at least nothing block memory reading.
I can easily RPM with C++, also get modules with C++, but I really want to use AutoIt and this library

Anyways, I'll check it out, debug it a bit and I'll see what's blocking it.

Originally Posted by Zyntex

Nothing unusual for a x64 process which is using QWORDs.
--
As far as I can see there are no erros regarding your code. Is anything blocking the access, e.g. an antivirus? Does your process have any protection like by an anticheat?

[Crowmer]

Hey KDeluxe, funktioniert das immernoch mit einem Windows 10 x64 (alle Updates) und aktuellem AutoIt?
Immer wenn ich Offsets nutzen möchte, schlägt das Lesen fehl. In AutoIt lese ich, dass sich etwas mit Arrays verändert hat...

Auch Dein Beispiel für das CE Tutorial funktioniert nicht mehr... "Can't read memory!"