How do I find a memory address programmatically...?

Question

1.00/5 (3 votes)

See more:

Hi Everyone!

I have a problem with a memory address.
I know that the memory addresses always change if the softwares close and open.
The problem is the memory address will be different when I close the target application and open another times.

How do I accomplish that my program always find the right memory address?
I wanna read an exact value this is my plan.

Please help with an example (source code). :)

Posted 8-Mar-15 5:49am

Roland-HE-C#

Add a Solution

Comments

[no name] 8-Mar-15 11:54am

What kind of value do you want to read?

Roland-HE-C# 8-Mar-15 12:01pm

Hexadecimal values to make a statistic for me and use it.
These hexadecimal values are numbers they don't demand convertion.

But it's boring when I start my program before I must always search the memory address with another program like cheat engine to I'm able to use my program without mistakes.

I wanna my program find the right address.

[no name] 8-Mar-15 12:07pm

Where do these values originate from? / Who or which program stores them at that memory address that you want to find?

Roland-HE-C# 8-Mar-15 12:17pm

A flash software (what doesn't have childwindows).
I have an idea for it with opcodes and jump...
but I can't use opcodes programmatically.

Sergey Alexandrovich Kryukov 8-Mar-15 12:15pm

Why all that? It does not seem to make any sense. Why would you need memory addresses? What are you trying to achieve?
—SA

Roland-HE-C# 8-Mar-15 12:18pm

I need memory address to the ReadProcessMemory winapi function.

[no name] 8-Mar-15 12:21pm

Can't help with that, sorry.

Sergey Alexandrovich Kryukov 8-Mar-15 12:42pm

All right, and what are you trying to achieve by that? If it unmanaged or managed memory?
—SA

Roland-HE-C# 8-Mar-15 12:47pm

Because I don't wanna waste my time for searching address before the starting.
From the managed one. :))

Sergey Alexandrovich Kryukov 8-Mar-15 12:49pm

Why searching address at all? What are you trying to achieve?
—SA

Roland-HE-C# 8-Mar-15 12:52pm

For the ReadProcessMemory winapi function.

Sergey Alexandrovich Kryukov 8-Mar-15 12:53pm

All right, why using this function? What are you trying to achieve?
—SA

Sergey Alexandrovich Kryukov 8-Mar-15 13:11pm

Please review my previous comments to the questions and your replies.

As you should be able to see now, you started from calling ReadProcessMemory and, in the cycle of answers to the questions: "Why? What are you trying to achieve?" you came to the same point. It create an "infinite" repetition cycle coming to the idea that you want to call this function for the sake of calling this function. But of course it could not be so. This is just a well-known bug related to recursion or mutual recursion, when the exit from recursion is not devised. Please see:
http://en.wikipedia.org/wiki/Recursion[^],
http://en.wikipedia.org/wiki/Recursion_%28computer_science%29[^].

I don't know if that is the bug is in your brain, motivation or communication; it is still a bug which needs a fix, but, from this point, it could be beyond the topics of this forum, sorry.

—SA

Roland-HE-C# 8-Mar-15 13:27pm

Yes. I use that function.
My problem is that I can't give a constant memory address into my program because at the next running the previous value of the address will be useless (but it will be available at a different address).

Roland-HE-C# 8-Mar-15 13:59pm

Can you help me to search in the opcodes? :))
And I wanna jump from it to another.

Sergey Alexandrovich Kryukov 8-Mar-15 15:49pm

No, you just going into the next cycle, probably even not noticing it. I don't help anything which may make no sense, sorry.
—SA

Roland-HE-C# 8-Mar-15 15:59pm

But it make sense.
I wanna find an opcode and get its memory address and add it another address this equals a new addres to jump the target memory address.

Sergey Alexandrovich Kryukov 8-Mar-15 16:23pm

Not that you volunteered to explain what is that sense. You never answered why doing all that, keep repeating same things in cycle. I'm afraid we have to stop this useless discussion, unless you want to radically change the way you discuss things.
—SA

Roland-HE-C# 9-Mar-15 3:22am

I don't wanna hack if you supposed to it about me.
I wanna find an given opcode by its text like move, or, push, sub, mul, etc.
And if I find that by its text after I wanna get its memory address and jump from it to its target address
in a Flash Application.

Sergey Alexandrovich Kryukov 9-Mar-15 8:24am

Why? :-)
—SA

Roland-HE-C# 9-Mar-15 12:41pm

Why? Because it will save my times at a longer term. :))
My program would search the target address during 1 sec.
Averagely I find the target address with cheat engine during 2-3 minutes.
So I'm slower.

Sergey Alexandrovich Kryukov 9-Mar-15 12:48pm

Why searching target address? You are going rounds.
—SA

Roland-HE-C# 9-Mar-15 13:04pm

Because more addresses appear in this process to reach the final/target. :))

Sergey Alexandrovich Kryukov 9-Mar-15 13:16pm

Why dealing with addresses at all? Why?

Let me tell you: you said "I know that the memory addresses always change if the softwares close and open." But this is for unmanaged addresses. Managed addresses are not like that: they are changed even during lifetime of the referenced object and all references to it. Never knew that? Did you ever perform pinning? In certain sense, managed memory addresses don't exist, they exist on the boundary between managed referenced objects and unmanaged memory, as volatile association between them.

I try to ask you about the purpose of your activity, but you simply go rounds.

—SA

Roland-HE-C# 9-Mar-15 13:37pm

I didn't know it, I'm medium begginer.
Thanks for put me in the picture.
But can you help me to find a given memory address without cheat engine? :))

Sergey Alexandrovich Kryukov 9-Mar-15 14:06pm

You need to learn to answer "why" questions first.
But... you need to pin memory, obtain a pointer and reinterpret-cast as, say, integer.
But this is useless: immediately after unpinning, it will be invalid.
—SA

Roland-HE-C# 9-Mar-15 14:47pm

Can you make me an example (code)? :))
Please.

Sergey Alexandrovich Kryukov 9-Mar-15 16:29pm

Please see the update to my question, after [EDIT].
—SA

Roland-HE-C# 9-Mar-15 3:24am

Is it possible?
Please help. :))

Richard MacCutchan 8-Mar-15 13:30pm

It's not possible unless you know the exact structure of the program in question. And even then it will not be easy.

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2015-03-08T06:03:00

Solution 1

In C# you almost never deal with memory addresses - in fact, you have to do two things at compile time in order to be allowed anywhere near them! First, you have to change your project properties to allow unsafe code, and then you have to mark the relevant code as an unsafe block in order to use pointers at all - and they are the only way to get an address.

You are not quite right to say "I know that the memory addresses always change if the softwares close and open." Memory addresses change "On the fly" while your application is running, as the stack usage changes, and as the Garbage Collector moved data around invisibly behind the scenes.

The whole idea behind C# is that you don't have to deal with memory yourself: so it's not easy (or safe) to even try.

What are you trying to achieve that you think you need this?

Posted 8-Mar-15 6:03am

OriginalGriff

Comments

Roland-HE-C# 8-Mar-15 12:13pm

I've read about Garbage Collector something it need unsafe running.

My plan is that I don't wanna use cheat engine before every running of my program.
With Cheat Engine I can find the address, but I want to find without it.
I think the opcodes helps me if I jump from it to the address of my target value.

OriginalGriff 8-Mar-15 12:23pm

At this point I will say that I will have nothing to do with this, as it is bordering right on the edge (and possibly a distance over the edge) of becoming malicious code: and we do not get involved in that in any way shape or form.

Cheating games is unfair, immoral, and can cause financial loss to others (depending on the game) and we are professionals, on a site for professional. I suggest you take your queries to a hacking site which is less likely to see anything wrong with your behaviour.

Roland-HE-C# 8-Mar-15 12:50pm

I don't want to cheat I wanna make a statistic for me to I will be better in that game.

[no name] 8-Mar-15 12:57pm

See if that "Cheat Engine" is a .Net application and if so, try to decompile it and learn how they did it there.

Roland-HE-C# 8-Mar-15 13:34pm

I don't know how the decompiling works.
I see a lots of opcodes mov, push, dword, xor...etc. and I don't understand they how work.

Sergey Alexandrovich Kryukov · Answer 2 · 2015-03-09T07:24:00

Solution 2

You are talking about managed memory. Let me tell you that the problem itself is not correctly posed. "Managed addresses" are not just something which is tricky to work with, never needed, or like that. The thing is: in certain sense, they don't even exist. The mapping between process linear memory of the process and CLR references is volatile and can be changed during the whole lifetime of a referenced object and all references to it. You can obtain some pointer only when you pin the object:
https://msdn.microsoft.com/en-us/library/23acw07k%28v=vs.110%29.aspx[^],
http://geekswithblogs.net/robp/archive/2008/08/13/speedy-c-part-3-understanding-memory-references-pinned-objects-and.aspx[^],
http://www.narfsoft.com/blog/memory-control-in-net-pinning-down-objects[^].

In all out discussion, you never explain the purpose of your activity; you simply go rounds. I see no evidence that you know your own purpose. If you think I'm wrong, you are more than welcome to explain this purpose. None of your explanations so far was not related to the purpose.

[EDIT]

You asked for some code sample. You can find one here: https://msdn.microsoft.com/en-us/library/f58wzh21%28VS.80%29.aspx[^].

Please don't tell me "this is not what I want". First, try to convince me that what you want makes sense; so far, I doubt that. That was my note, just in case.

—SA

Posted 9-Mar-15 7:24am

Sergey Alexandrovich Kryukov

Updated 9-Mar-15 10:28am

v2

Comments

Roland-HE-C# 10-Mar-15 3:54am

The advantage/target of my plan is that I get the necessary knowledge to my project.
My project is an application that automatically write datas from another program in a txt file and in a textbox.

My program is work well but it's not excellent for me yet.
I can't write in my program constant memory address because that doesn't work more than one times so next time I must be search again the necessary memory address to my program to work well.

The necessary memory address what is needed to me it every runtime changes.
And I need your help to solve my problem. :))

Sergey Alexandrovich Kryukov 10-Mar-15 7:40am

Well, it is interesting, but what is that program do? What is another program? One fixed program or anything? .NET application?
First, you said that it "writes datas from another program in a text file and in a textbox". It means that it reads from memory. Below, you said "I cannot write in my program...". So, do you read from process's memory or write?
And why doing it all?
—SA

Roland-HE-C# 10-Mar-15 9:14am

Yes I read process memory (kernell.dll).
And I learn something during the last days about it thank you too.
I wanna use a pointer or pointers to always have a fix memory address for me. :))
But I currently can't work with pointers to write sourcecodes.

Sergey Alexandrovich Kryukov 10-Mar-15 10:54am

I think I explained the reason why in .NET applications nothing is fixed. And I still don't understand why you are doing all that.
—SA

Roland-HE-C# 10-Mar-15 11:22am

I've explained everything above.
But I asked a code example for pointer using to memory address.
Please write me one. :))

Sergey Alexandrovich Kryukov 10-Mar-15 13:17pm

No, you didn't. We have different criteria...
—SA

Roland-HE-C# 10-Mar-15 14:18pm

I've said I don't wanna use dinamic address directly, because it's always change when I close the program.
But I know its pointer and I wanna use this pointer to jump to the dinamic address from that pointer.

Sergey Alexandrovich Kryukov 10-Mar-15 15:21pm

Did you notice that I pointed out the code sample, in my answer, after [EDIT]?
—SA