访问另一个程序的值

Question

So, I've been wondering that how I access values of different program with my c++ code.

I understand that I have to know the memory location and access it somehow but I don't really know how.

Let's say that I have a game where I have a character that has a certain amount of health and I want to read that health with my c++ code (similar to how you can read different values with the cheat engine program).

How would I accomplish this?

For clarity: Operating system is windows

Answer 1

You can use the ReadProcessMemory / VirtualQuery (safer than ReadProcessMemory) and WriteProcessMemory functions.

If you are clever you can inject a DLL, then you can use pointers in your code

int * money = 0x00400000+0x00ABCDEF;//pointer to money address
*money = 5000;//set money to 5000.

if you need DLL examples, here are some:

Red Alert 3 Player Information Mod

Need for Speed: Underground 2 cheat mod

Sometimes pointers can change what they point to, this can be "dangerous" in terms of the application.

When you access a pointer which points to a protected memory area, inaccessible memory, not to the stuff you want or an invalid location your application may crash. I don't know how Cheat Engine prevents it but you have a few options, the ones I suggest:

• Exit application gracefully and let the user know you couldn't handle it
• Handle the problem with a try / catch block instead? (be sure to capture the correct error)
• Hard exit the application
• Do nothing and let the application behave weird / crash
• ... more and more

I also wrote pointer class myself which handles the dereferencing and stops when an error is encountered (returns null)

//null as last parameter automaticly "Dereferences"
template<class T = DWORD, class S = DWORD> struct Pointer
{
private:
    std::vector<S> params;
    S variable;
    bool MoreThanOne;
public:
    //null as last parameter automaticly "Dereferences"
    template<class... Args> 
    Pointer(Args... args) 
    {  
        std::array<S, sizeof...(args)> list = {args...};
        for( auto i : list)
            params.push_back(i);
        if(params.size() > 1)
            MoreThanOne = true;
        else
            MoreThanOne = false;
    }
    T ResolvePointer() 
    {  
        variable = params[0];
        if(!MoreThanOne)
            return (T)variable;
        try
        {
            auto it = params.begin();
            ++it;  
            for(; it != params.end(); ++it)
            {
                if(*reinterpret_cast<S*>(variable) == NULL)
                    return static_cast<T>(NULL);
                variable = *reinterpret_cast<S*>(variable) + *it;
            }
        }
        catch(...)
        {   
            return static_cast<T>(NULL);
        }
        return (T)variable;
    }
    T operator()()
    {
        return ResolvePointer();
    }
};

usage:

unsigned long ipaddr = htonl(Pointer<unsigned long>(0x00400000+0x008E3A74,0x04,0x38,NULL)());//pointer to players IP address
if(ipaddr != NULL)//....

Answer 2

You should not write to another process's memory space without using specific IPC mechanisms. Operating systems typically prevent this for obvious reasons. Instead, you would need to use the target application's extension mechanisms, or decompile / modify / hex edit to effect the changes you want. That being said, doing so may be in violation of the terms of service for the software you are messing with.

To be clear, the code will compile just fine, letting you set a pointer to whatever arbitrary address you'd like, but once you try to read or write that address, the OS will step in and cause an error condition.

If you aren't violating the software's EULA by doing so, here are some pointers for finding things you might like to modify:

• If the code can be decompiled into some readable source form, do so and make modifications there.
• Edit the compiled binary with a hex editor, look for well-defined values and change them (does the max_health always start out at 25? That might be unique enough to locate and modify). A note about this: Make sure the values you intend to insert fit in the same space as the original values, otherwise you will break things and have undefined results.
• Does the application provide an extension mechanism, such as a scripting API or mod support? If so, this can be a vector for causing the types of system changes you want.

Answer 3

You can't access variables in another process unless:

1. Your program uses "debug functions" to access the values.
2. You use some sort of IPC (shared memory, pipes, message queues) to share/transfer the data.

Each process has its own address space [1], and there is no way to access into another process's address space without some mechanism to access it.

[1] Assuming we're talking about a "real" OS that uses proper memory management. In some OS's such as traditional DOS, there is no memory protection between processes. But no sane person works with these OS's unless the system is running with a very feeble processor and small amounts of memory.