[2008] How to retrieve value from exe?

[rhijaen]

Not sure how to word this right as I've never done it before. Also not sure which language I should code it in..

How would I go about getting a value from an exe if I already know what address it's located at?

For example..in the app I'm making that calculates the current xp per hour, I need to be able to retrieve the total xp on my char from the game exe. I already know that the xp is located at 0080B910 and can see it with my debugger.

I just need to grab that value and put it into a var in my program.

The only language I'm semi-decent at is VB .NET but am willing to learn more if needed, I'll have to eventually anyways.

Help me out here guys =)

[Jenner]

You'd use ReadProcessMemory in kernel32.

   Private Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer

[rhijaen]

Thanks

I think I've almost got it.

I just don't understand what I'm supposed to use for lpBuffer and lpNumberOfBytesWritten.

var is coming out as 0..

What are lpBuffer and lpNumberOfBytesWritten supposed to be?

    Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As IntPtr
    Declare Function FindWindow Lib "user32.dll" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As System.IntPtr
    Private Sub btnCurrentXP_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnCurrentXP.Click
        Dim var As String
        Dim windowhandle As IntPtr
        windowhandle = FindWindow(vbNullString, "My Window Handle")

        var = ReadProcessMemory(windowhandle, 8435984, 0, 8, 0)

        MsgBox(var)
    End Sub

[Jenner]

lpBuffer is where it puts the result. lpNumberOfBytesWritten will be 0. Most of the Windows API functions are, I think the term is, "reflexive". That is, you give them an empty variable as one of their arguments, the function uses that as a pointer for where to stuff results. It's very handy if you want to return multiple values from a single function. VB.NET can do similar things.

    Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As IntPtr
    Declare Function FindWindow Lib "user32.dll" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As System.IntPtr
    Private Sub btnCurrentXP_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnCurrentXP.Click

        Dim windowhandle As IntPtr
        Dim intResult As Long
        windowhandle = FindWindow(vbNullString, "My Window Handle")

        'You are reading 8 bytes from offset 8435984 from process 
        '"windowhandle" and returning the result into intResult.
        ReadProcessMemory(windowhandle, 8435984, intResult, 8, 0)

        MsgBox(intResult)
    End Sub

[chapperzUK]

If you want to use it for a different program/executable file then what do you need to change and how do you know where to find that piece of information required?

[chapperzUK]

Can anyone one help me?

Much appreciated