C++ 内存地址和偏移读取 - 64 位

Question

我在尝试计算带有偏移量的内存地址时遇到了一些麻烦。

注意：我可以做 32 位，但我需要使用 64 位地址。

我的示例是这个地址：0x000002586F08CE30，偏移量为 0x88。 当我得到这个添加时，它的地址是：0x2586F08CEB8，而它应该是：0x25825C4C880

我试过这个：

void aVoid()
{
    DWORD64* add = (DWORD64*)0x000002586F08CE30;
    cout << add << endl;

    DWORD64* off = (DWORD64*)0x88;
    cout << off << endl;

    DWORD64* BaseTimeAddress = (DWORD64*)((char*)add + (DWORD64)off);
    cout << BaseTimeAddress << endl;    // Gets 000002586F08CEB8
}

我在哪里得到 0x25825C4C880：（ https://i.stack.imgur.com/5K4eP.png ）

完整代码

#include <iostream>

#include <windows.h>

#include <string>
#include <vector>
#include <tchar.h>
#include <stdlib.h>
#include <tlhelp32.h>

`
using namespace std;

DWORD GetModuleBaseAddress(TCHAR* lpszModuleName, DWORD pID) {
    DWORD dwModuleBaseAddress = 0;
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pID); // make snapshot of all modules within process
    MODULEENTRY32 ModuleEntry32 = { 0 };
    ModuleEntry32.dwSize = sizeof(MODULEENTRY32);
    
    if (Module32First(hSnapshot, &ModuleEntry32)) //store first Module in ModuleEntry32
    {
        do {
            if (_tcscmp(ModuleEntry32.szModule, lpszModuleName) == 0) // if Found Module matches Module we look for -> done!
            {
                dwModuleBaseAddress = (DWORD_PTR)ModuleEntry32.modBaseAddr;
                break;
            }
        } while (Module32Next(hSnapshot, &ModuleEntry32)); // go through Module entries in Snapshot and store in ModuleEntry32


    }
    CloseHandle(hSnapshot);
    return dwModuleBaseAddress;
}

DWORD GetPointerAddress(HWND hwnd, DWORD gameBaseAddr, DWORD address, vector<DWORD> offsets)
{
    DWORD pID = NULL; // Game process ID
    GetWindowThreadProcessId(hwnd, &pID);
    HANDLE phandle = NULL;
    phandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
    if (phandle == INVALID_HANDLE_VALUE || phandle == NULL);

    DWORD offset_null = NULL;
    ReadProcessMemory(phandle, (LPVOID*)(gameBaseAddr + address), &offset_null, sizeof(offset_null), 0);
    DWORD pointeraddress = offset_null; // the address we need

    for (int i = 0; i < offsets.size() - 1; i++) // we dont want to change the last offset value so we do -1
    {
        ReadProcessMemory(phandle, (LPVOID*)(pointeraddress + offsets.at(i)), &pointeraddress, sizeof(pointeraddress), 0);
        //cout << "ADD: " << &pointeraddress << endl;
    }
    return pointeraddress += offsets.at(offsets.size() - 1); // adding the last offset
}

#include <Psapi.h>

DWORD_PTR GetProcessBaseAddress(DWORD processID)
{
    DWORD_PTR   baseAddress = 0;
    HANDLE      processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
    HMODULE* moduleArray;
    LPBYTE      moduleArrayBytes;
    DWORD       bytesRequired;

    if (processHandle)
    {
        if (EnumProcessModules(processHandle, NULL, 0, &bytesRequired))
        {
            if (bytesRequired)
            {
                moduleArrayBytes = (LPBYTE)LocalAlloc(LPTR, bytesRequired);

                if (moduleArrayBytes)
                {
                    unsigned int moduleCount;

                    moduleCount = bytesRequired / sizeof(HMODULE);
                    moduleArray = (HMODULE*)moduleArrayBytes;

                    if (EnumProcessModules(processHandle, moduleArray, bytesRequired, &bytesRequired))
                    {
                        baseAddress = (DWORD_PTR)moduleArray[0];
                    }

                    LocalFree(moduleArrayBytes);
                }
            }
        }

        CloseHandle(processHandle);
    }

    return baseAddress;
}

int main() {
    //HWND hWnd = FindWindowA(NULL, "Halo Wars: Definitive Edition");
    //char gameModule1[] = "xgameFinal.exe";
    DWORD64 address = 0x00000258722B0AB0;

    float nVal = 2000;

    HWND hWnd = FindWindowA(0, "Halo Wars: Definitive Edition");
    if (hWnd == 0) {
        cerr << "Could not find window." << endl;
    }
    else {
        DWORD PID;
        GetWindowThreadProcessId(hWnd, &PID);
        HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, false, PID);

        if (!hProc) {
            cerr << "Cannot open process." << endl;
        }
        else {



            DWORD64* add = (DWORD64*)0x000002586F08CE30;
            cout << add << endl;

            DWORD64* off = (DWORD64*)0x88;
            cout << off << endl;


            DWORD64* BaseTimeAddress = (DWORD64*)((char*)add + (DWORD64)off);
            cout << BaseTimeAddress << endl;

            DWORD64* com = (DWORD64*)add;
            cout << com << endl;
            //cout << &add << endl;


            DWORD_PTR baseAddr2 = GetProcessBaseAddress(PID);
            cout << "base" << &baseAddr2 << endl;
            cout << "base"<<baseAddr2 << endl;
            cout << "base" <<hex<< baseAddr2 << endl;
            DWORD64 offset_null = NULL;
            DWORD64 add2 = ReadProcessMemory(hWnd, (LPVOID*)(baseAddr2 + 0x014FA250), &offset_null, sizeof(offset_null), 0);
            cout << &add2 << endl;

            cout << &offset_null << endl;

            ReadProcessMemory(hWnd, (LPVOID*)(baseAddr2 + 0x014FA250 + 0x88+0x8+0x110), &offset_null, sizeof(offset_null), 0);
            cout << &offset_null << endl;

            cout << "END";









            char gameModule1[] = "xgameFinal.exe";
            DWORD_PTR baseAddr1 = GetProcessBaseAddress(PID);
            cout << hex << baseAddr1 << endl;
            cout << &baseAddr1 << endl;
            DWORD64 baseAddr = GetModuleBaseAddress(_T(gameModule1), PID);

            /*
            
            char gameModule1[] = "ac_client.exe";

            DWORD baseAddr = GetModuleBaseAddress(_T(gameModule1), procID);
            DWORD pointsAddr = 0x0018AC00;
            vector<DWORD> pointsOffesets = { 0x11C };
            //cout << std::hex << pointsAddr << endl;
            DWORD pointsPtrAddr = GetPointerAddress(hWnd, baseAddr, pointsAddr, pointsOffesets);
            //010FF974
            //cout << pointsPtrAddr << endl << &pointsPtrAddr << endl;
            int val = 1;


            ReadProcessMemory(handle, (LPVOID*)(pointsPtrAddr), &val, sizeof(val), 0);
            cout << "Value: " << val << endl;

            cout << "Pointer Address: " << std::hex << pointsPtrAddr << endl;

            cout << "WORKS";
            //"xgameFinal.exe"+016208B0
            */




          /*  DWORD64* BaseAddress = (DWORD64*)GetModuleHandle(NULL);
            DWORD64* address = (DWORD64*)((char*)BaseAddress + 0x014FA250);
            address = (DWORD64*)((char*)*address + 0x88 + 0x8 + 0x110);
            float currentTime = *(float*)address;

            cout << currentTime;
            cout << "END";
            */







            ReadProcessMemory(hProc, (LPVOID)address, &nVal, (DWORD64)sizeof(nVal), NULL);
            cout << nVal;
            CloseHandle(hProc);

            cin.get();

        }

    }
    return 0;

}
`

Answer 1

DWORD64* BaseTimeAddress = (DWORD64*)((char*)add + (DWORD64)off);

通过执行(char*)add ，您可以让+运算符在 char 中添加一个偏移量。 字符是 1 个字节。 像这样，

0x000002586F08CE30 + 0x88 = 0x2586F08CEB8

是正确的。 您指定的其他地址已完全关闭。 你从哪里弄来的？

在您链接的图像中，有一个类型字段。 您可能需要将您的行更改为类型转换为这种类型：

DWORD64* BaseTimeAddress = (DWORD64*)((float*)add + (DWORD64)off);

这意味着：偏移add ， off float的数量。 但是，这种对指针的低级修改很容易导致 C++ 中的未定义行为，除非您非常小心。 您需要了解reinterpret_cast及其局限性。

Answer 2

我想到了。 我确实想感谢@Jeffrey 和@RaymondChen，因为他们的帖子帮助我更好地思考了这个问题。

所以很快我会在下面发布代码，然后再解释一下：

void code()
{
    /*1*/ DWORD64* test6 = (DWORD64*)0x2586F08CE30; cout << test6 << endl;
    /*2*/ DWORD64* test7 = (DWORD64*)0x88; cout << test7 << endl;
    /*3*/ DWORD64* test8;
    /*4*/ DWORD64* test9;
    /*5*/ ReadProcessMemory(hProc, (LPVOID*)((DWORD64)test6+ (DWORD64)test7), &test8, sizeof(test8), 0);
    /*6*/ ReadProcessMemory(hProc, (LPVOID*)((DWORD64)test8 + (DWORD64)0x8), &test9, sizeof(test9), 0);
    /*7*/ DWORD64* test2 = (DWORD64*)0x110;
    /*8*/ //cout << test2 << endl;
    /*9*/ DWORD64* test3 = (DWORD64*)((char*)test9 + (DWORD64)test2);
    /*10*/ //cout << test3 << endl;
    /*11*/ float currentTime = 0;
    /*12*/ ReadProcessMemory(hProc, (LPVOID*)test3, &currentTime, sizeof(currentTime), 0);
    /*13*/ //cout << test3 << endl;
    /*14*/ cout << currentTime << endl;
}

这是来自作弊引擎的图像，其中包含所有数据： https ://i.stack.imgur.com/5K4eP.png

图片

所以我从现在从作弊引擎获得的 0x2586F08CE30 开始，但是“xgameFinal.exe”+014FA250 = 0x2586F08CE30

所以接下来我需要获取该地址并将其与偏移量 0x88 组合，在第 5 行我这样做了。

接下来是从 test8 中获取该地址并组合偏移量 0x8。 （@第 6 行）

接下来是最后一个偏移量（0x110），这是@RaymondChen 评论帮助我的地方。

屏幕截图显示 [2586F08CE30 + 88] 但你计算了 2586F08CE30 + 88。 – Raymond Chen

所以在第 9 行是我获得最终地址和值的地方。