.Net C# ReadProcessMemory Pointer function returns address backwards

Question

I'm new to posting on these forums but have come here multiple times for my programming help needs and have usually been able to find my answers fairly easily but I fear I might be either asking the wrong kind of questions or maybe it's very obvious and I just don't see it but here is my problem.

I am making my first trainer for Quake, I thought I would start small with a game that is easy to find pointers for instead of my other games which usually have 2+ level pointers. So I go through Quake with Cheat Engine and grab all the pointers I need, Make my gui etc but there is a problem. I read my first pointer and it returns the address I need backwards :/

Example:

Here is my pointer that i'm reading from - 006C5214

when read it gives me this address - 02BFD940

I then add my offset 48C to my address above which directs me to 02BFDDCC which contains the value I need.

when I read my pointer with ReadProcessMemory I get the correct address except it's backwards (endian?)

I need 02BFD940 I get 40D9BF02

I've tried everything I can think of to flip around the order and get it back into an IntPtr for use in my ReadProcessMemory/WriteProcessMemory. I am able to flip it around in the order I want because my ReadProcessMemory gives my address like 40-D9-BF-02 which is easily cut into an array with Split('-');

Only problem is that after i'm done splitting and reordering it the way I want there is no way I can manage to convert it back into an IntPtr for use with my reading and writing memory functions.

I've always done my memory editing things with cheat engine or a disassembler. This is my first attempt at a fully working trainer any help with my problem would be much appreciated. I've tried setting the endian boolean on my BitConverter but it's read only :/

If i'm completely missing something and it's right there infront of me feel free to call me out on it and give me a slap upside the head xD I don't mind.

-P.S. your guys' forum is awesome.

It seems you get data in the opposite endianess, as you suspect. A simple Array.Reverse(byte[4]) should do the trick. — leppie
– leppie, Commented Aug 26, 2011 at 7:24

Yahia · Accepted Answer · 2011-08-26 07:28:00Z

3

try

    byte[] buffer = new byte[4];
    int bytesread;

    ReadProcessMemory(hProcess, dwAddress, buffer, 4, out bytesread);

    IntPtr P = new IntPtr (BitConverter.ToInt32(buffer, 0));

edited Aug 26, 2011 at 7:28

answered Aug 26, 2011 at 7:12

Yahia

70.5k9 gold badges117 silver badges147 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Tsproggy Over a year ago

Thank you, this solves my order problem but I think I need it back into hexidecimal form in order for my ReadProcessMemory function to work properly. Or would it also accept an integer as an address input?

Yahia Over a year ago

I don't understand - ReadProcessMemory takes IntPtr, not hex ?

Tsproggy Over a year ago

Sorry for the confusion, I just tried letting ReadProcessMemory use my int32 address and it worked perfectly! then I added my offset to it and got the value I wanted! Thank you very much for your help :) @Yahia sorry that was my mistake, for some reason I thought ReadProcessMemory only accepted Hexidecimal as an address input but turns out it takes ints and intptrs aswell.

Yahia Over a year ago

glad I could help - please don't forget to upvote/mark as accepted if an answer was helpful...

Tsproggy Over a year ago

:( I try but it says I require 15 reputation I will have to revisit this post once I gain some.

Collectives™ on Stack Overflow

.Net C# ReadProcessMemory Pointer function returns address backwards

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related