[Question] VB.Net and process memory

purplehaze · 07/27/2008, 17:41

Hello, Im having some trouble with read/write process Memory and Im hoping someone here could help me out a little.

Code:

Code:

        Dim iMoneyAddress As Integer
        iMoneyAddress = 90720324
        Dim Reader As New MemReader.ProcessMemoryReader()
        Dim MyProcs As System.Diagnostics.Process() = System.Diagnostics.Process.GetProcessesByName("Conquer")

        If MyProcs.Length = 0 Then
            MessageBox.Show("No Conquer Client found!")
            Return
        End If
        Reader.ReadProcess = MyProcs(0)
        Reader.OpenProcess()
        Dim bytesRead As Integer
        Dim Memory As Byte()
        Dim iMoney As Integer

        Memory = Reader.ReadProcessMemory(iMoneyAddress, 1, bytesRead)
        iMoney = Memory(0)
        txtMoney.Text = iMoney.ToString()

now there must be something wrong with my code because it is supposed to read the memory address 90720324 (&H56BE7C) *tried both but both didnt succeed..*

So if anyone could provide me some help or a working sample in VB.Net it would be very appreciated

P.S dont look at my sloppy coding and if need further info just ask, the class just contains the declarations and such

link · 07/27/2008, 23:28

56BE7C => 5684860
5684844 => 90720324

56BE7C => 90720324?

Dim Memory As Byte()
|| Label for a Row of Bytes in Memory

Dim iMoney As Integer
|| Label for 4 Bytes in Memory

ReadProcessMemory(iMoneyAddress, 1, bytesRead)
|| Read 1 Byte at iMoneyAddress

iMoney = Memory(0)
|| mov al, [Memory]
|| mov BYTE ptr [iMoney], al
||
|| iMoney gets the first Byte at Address of Memory

1 BYTE = FF = 255
2 BYTE = FFFF = 65535
3 BYTE = FFFFFF = 16777215
4 BYTE = FFFFFFFF = 4294967295

Money : 288901 Currency
In Hex: 46885
First Byte: 133

1. Read more Bytes
2. Allocate more Bytes of Memory to iMoney

purplehaze · 07/28/2008, 00:45

Quote:

Originally Posted by link

56BE7C => 5684860
5684844 => 90720324

56BE7C => 90720324?

Dim Memory As Byte()
|| Label for a Row of Bytes in Memory

Dim iMoney As Integer
|| Label for 4 Bytes in Memory

ReadProcessMemory(iMoneyAddress, 1, bytesRead)
|| Read 1 Byte at iMoneyAddress

iMoney = Memory(0)
|| mov al, [Memory]
|| mov BYTE ptr [iMoney], al
||
|| iMoney gets the first Byte at Address of Memory

1 BYTE = FF = 255
2 BYTE = FFFF = 65535
3 BYTE = FFFFFF = 16777215
4 BYTE = FFFFFFFF = 4294967295

Money : 288901 Currency
In Hex: 46885
First Byte: 133

1. Read more Bytes
2. Allocate more Bytes of Memory to iMoney

I appreciate your help a lot, but I dont really understand it.
This table and such only confused me more.
Could you maybe explain it easier, i have no experience with Memory reading but im trying

This is what i understand I need to read 4 bytes apparently im reading 1 so how do I read 4? because changing that 1 to 4 doesnt work lol.
If you have the time please explain it

And if you have a code sample for VB.Net that would help me a lot!

Im really stuck at this for days lol

edit:

Is this what you meant:

Memory = Reader.ReadProcessMemory(iMoneyAddress, 4, bytesRead)
iMoney = Memory(0)
iMoney = Memory(1)
iMoney = Memory(2)
iMoney = Memory(3)

That returns a value of 255 so making progress here lol not quite right yet tho

link · 07/28/2008, 02:30

Quote:

56BE7C => 5684860
5684844 => 90720324

56BE7C => 90720324?

"address 90720324 (&H56BE7C) *tried both but both didnt succeed..*"
90720324 is not 56BE7C in hexa.

Quote:

Dim Memory As Byte()
|| Label for a Row of Bytes in Memory

Dim iMoney As Integer
|| Label for 4 Bytes in Memory

ReadProcessMemory(iMoneyAddress, 1, bytesRead)
|| Read 1 Byte at iMoneyAddress

iMoney = Memory(0)
|| mov al, [Memory]
|| mov BYTE ptr [iMoney], al
||
|| iMoney gets the first Byte at Address of Memory

1 BYTE = FF = 255
2 BYTE = FFFF = 65535
3 BYTE = FFFFFF = 16777215
4 BYTE = FFFFFFFF = 4294967295

Money : 288901 Currency
In Hex: 46885
First Byte: 133

Explanation of your mistake.

Quote:

1. Read more Bytes
2. Allocate more Bytes of Memory to iMoney

Solution.

Try to read 4 Bytes (I don't know if the money requires 4, 2 or 8 Bytes, try it yourself [288901 are 3 Bytes]) and parse Memory to 32bit (4 Bytes) Value.

purplehaze · 07/28/2008, 03:20

Quote:

Originally Posted by link

"address 90720324 (&H56BE7C) *tried both but both didnt succeed..*"
90720324 is not 56BE7C in hexa.

Explanation of your mistake.

Solution.

Try to read 4 Bytes (I don't know if the money requires 4, 2 or 8 Bytes, try it yourself [288901 are 3 Bytes]) and parse Memory to 32bit (4 Bytes) Value.

I think this is too deep for me, because i have absolutely no clue what you just said lol, so if i get this straight depending on the amount of money u have the amounts of bytes change, that i didnt know!
so if i have 1 mill money with me thats still 3? or 4?
See now im even more confused lol.
All i want is to retrieve a value from a specific address and well it will always change i mean you get more money and less, you get the point its not really something i can "set" so no matter how many.
And parsing memory to 4 bytes I have no clue how to do that, i got experience with VB.Net just not with this whole memory thing.

I just cant believe reading a value is this difficult to understand for me, it sounds so easy.
I dont want to give up on this and i really need some code example, I googled for forever and all i find is for VB6 and C# just not a complete sample for vb.net

About the 2 values, must have copied wrong 1 from ini file

All values stored in a ini file so when i can read a value i can experiment with more just need the base of this to work

I changed my code to this:

Code:

        Dim iMoneyAddress As Integer
        iMoneyAddress = 90720324
        Dim Reader As New ProcessMemoryReader()
        Dim MyProcs As System.Diagnostics.Process() = System.Diagnostics.Process.GetProcessesByName("Conquer")

        If MyProcs.Length = 0 Then
            MessageBox.Show("No Conquer Client found!")
            Return
        End If
        Reader.ReadProcess = MyProcs(0)
        Reader.OpenProcess()
        Dim bytesRead As Integer
        Dim Memory As Byte()
        Dim iMoney As Integer

        Memory = Reader.ReadProcessMemory(iMoneyAddress, 4, 4, bytesRead)
        iMoney = Memory(0)

        For i = 0 To Memory.Length - 1
            txtMoney.Text += Memory(i).ToString
        Next

But still not receiving the value i should get

I also changed my function for ReadProcessMemory for the size of the bytes
wich i have set to 4 :
Memory = Reader.ReadProcessMemory(iMoneyAddress, 4, 4, bytesRead)

Anyway thanks again for your help sorry im a pain in the ass, but i just dont get it lol

link · 07/28/2008, 14:33

4 Byte/32bit : 00000000 00000000 00000000 00000000

288901 : 00000000 00000100 01101000 10000101 (Since 3 is not a power of 2, it's 4 Byte)

Reading the first Byte/eight Bit : 10000101

Reading the next Bytes : 01101000, then 00000100

x (4 Byte) : 100b

x << 8

[x = 100 00000000b]

x (in first Byte) : 1101000b

x << 8

[x = 100 01101000 00000000b]

x (in first Byte) : 10000101b

[x = 100 01101000 10000101b]

Code:

	mov pp, 100b
	shl pp, 8
	mov BYTE ptr [pp], 1101000b
	shl pp, 8
	mov BYTE ptr [pp], 10000101b

Or with direct Memory Access:

Code:

	mov BYTE ptr [pp], 10000101b
	mov BYTE ptr [pp + 1], 1101000b
	mov BYTE ptr [pp + 2], 100b

You have to know, how to access directly the Bytes in VB :-)

Visualization:
Reversed in Memory, Value 288901 : 10000101 01101000 00000100 00000000

ReadProcessMemory, 4 Bytes.

Memory[0] = 10000101

Memory[1] = 01101000

Memory[3] = 00000100

Memory[4] = 00000000

Now put these Bytes with the principle FIFO in iMoney (Memory[0] in first Byte of iMoney, Memory[1] in second, etc.).