[Vbnet Frage:] ProcessModule.BaseAddress

[Bl1zz4rD]

Hallo,

seit einem Patch von einem Spiel haben die nun "ASLR".
Somit muss man nun Spiel.exe + Offset rechnen.

Auf MSDN | Microsoft Development, Subscriptions, Resources, and More (http://msdn.microsoft.com) hab ich schon was dazu gefunden:


Dim myProcess As New Process()
' Get the process start information of notepad.
Dim myProcessStartInfo As New ProcessStartInfo("notepad.exe")
' Assign 'StartInfo' of notepad to 'StartInfo' of 'myProcess' object.
myProcess.StartInfo = myProcessStartInfo
' Create a notepad.
myProcess.Start()
System.Threading.Thread.Sleep(1000)
Dim myProcessModule As ProcessModule
' Get all the modules associated with 'myProcess'.
Dim myProcessModuleCollection As ProcessModuleCollection = myProcess.Modules
Console.WriteLine("Base addresses of the modules associated " + _
"with 'notepad' are:")
' Display the 'BaseAddress' of each of the modules.
Dim i As Integer
For i = 0 To myProcessModuleCollection.Count - 1
myProcessModule = myProcessModuleCollection(i)
Console.WriteLine(myProcessModule.ModuleName + " : " + _
myProcessModule.BaseAddress.ToString())
Next i
' Get the main module associated with 'myProcess'.
myProcessModule = myProcess.MainModule
' Display the 'BaseAddress' of the main module.
Console.WriteLine("The process's main module's base address is: " + _
myProcessModule.BaseAddress.ToString())
myProcess.CloseMainWindow()

Aber das funktioniert irgendwie nur mit Notepad und auch nur wenn es sich in dem moment auch startet, ich will aber eigentlich nur die BaseAddress vom Spiel und zwar auch nur von der, der in der Combobox steht (PID - Process ID)

[The_Funeral]

Wenn ich dich halbwegs richtig verstehe willst du so etwas in der Art:
(Der Code ist zu ~80 von ProcessModule.BaseAddress-Eigenschaft (System.Diagnostics) (http://msdn.microsoft.com/de-de/library/system.diagnostics.processmodule.baseaddress.aspx) ). Musste nur ein paar kleine Veränderungen durchnehmen.

Evtl. Gibt es noch elegantere Methoden.



class BaseAdresse
{
static void Main(string[] args)
{
foreach(Process _process in Process.GetProcessesByName("firefox")) //change in our GameName
{
GetBaseAddress(_process.Id, _process.ProcessName);
}
}

private static void GetBaseAddress(int ProcessID, string ProcessName)
{
Process myProcess = Process.GetProcessById(ProcessID);

ProcessModule myProcessModule;
// Get all the modules associated with 'myProcess'.
ProcessModuleCollection myProcessModuleCollection = myProcess.Modules;
Console.WriteLine("Base addresses of the modules associated "
+ "with "+ ProcessName+" are:");
// Display the 'BaseAddress' of each of the modules.
for (int i = 0; i < myProcessModuleCollection.Count; i++)
{
myProcessModule = myProcessModuleCollection[i];
Console.WriteLine(myProcessModule.ModuleName + " : "
+ myProcessModule.BaseAddress);
}
// Get the main module associated with 'myProcess'.
myProcessModule = myProcess.MainModule;
// Display the 'BaseAddress' of the main module.
Console.WriteLine("The process's main module's base address is: "
+ myProcessModule.BaseAddress);

//myProcess.CloseMainWindow();
Console.ReadLine();
}
}
Ich denke den VB Code kannst du dir davon ableiten, bzw konvertieren...

[Bl1zz4rD]

Wenn ich dich halbwegs richtig verstehe willst du so etwas in der Art:
(Der Code ist zu ~80 von ProcessModule.BaseAddress-Eigenschaft (System.Diagnostics) (http://msdn.microsoft.com/de-de/library/system.diagnostics.processmodule.baseaddress.aspx) ). Musste nur ein paar kleine Veränderungen durchnehmen.

Evtl. Gibt es noch elegantere Methoden.



class BaseAdresse
{
static void Main(string[] args)
{
foreach(Process _process in Process.GetProcessesByName("firefox")) //change in our GameName
{
GetBaseAddress(_process.Id, _process.ProcessName);
}
}

private static void GetBaseAddress(int ProcessID, string ProcessName)
{
Process myProcess = Process.GetProcessById(ProcessID);

ProcessModule myProcessModule;
// Get all the modules associated with 'myProcess'.
ProcessModuleCollection myProcessModuleCollection = myProcess.Modules;
Console.WriteLine("Base addresses of the modules associated "
+ "with "+ ProcessName+" are:");
// Display the 'BaseAddress' of each of the modules.
for (int i = 0; i < myProcessModuleCollection.Count; i++)
{
myProcessModule = myProcessModuleCollection[i];
Console.WriteLine(myProcessModule.ModuleName + " : "
+ myProcessModule.BaseAddress);
}
// Get the main module associated with 'myProcess'.
myProcessModule = myProcess.MainModule;
// Display the 'BaseAddress' of the main module.
Console.WriteLine("The process's main module's base address is: "
+ myProcessModule.BaseAddress);

//myProcess.CloseMainWindow();
Console.ReadLine();
}
}
Ich denke den VB Code kannst du dir davon ableiten, bzw konvertieren...

Klappt wunderbar.
Dann kann es geclosed werden :)