Can't get real address of C++ program

Mr Valera 0
Viewed 64

With the help of the script that will be below, I get the "base address" of the program where it wants to become, but in fact it gets further, apparently due to the fact that the RAM is busy.

How can I get a real address?

Example:

modulBase = 0x400000
Actual address: 0x17E0A8

uintptr_t GetModuleBaseAdress(DWORD procId, const wchar_t* modName) {

    uintptr_t modBaseAddr = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);
    
    if (hSnap != INVALID_HANDLE_VALUE) {

        MODULEENTRY32 modEntry;
        modEntry.dwSize = sizeof(modEntry);

        if (Module32First(hSnap, &modEntry)) {

            do {

                if (!_wcsicmp(modEntry.szModule, modName)) {

                    modBaseAddr = (uintptr_t)modEntry.modBaseAddr;
                    break;
                }

            } while (Module32Next(hSnap, &modEntry));

        }

    }
    CloseHandle(hSnap);
    return modBaseAddr;
}

Does anyone know how to solve this?

winapi c++
1 Answers

MODULEENTRY32::modBaseAddr is documented as:

modBaseAddr

The base address of the module in the context of the owning process.

That means it is a relative value. To get the absolute address, you need the load address of the owning process, then you can add modBaseAddr to it. To get the load address of the process, get the modBaseAddr of the .exe module that created the process.

Alternatively, to get the address of a particular module in a process, use EnumProcessModules() and GetModuleFileNameEx()/GetModuleBaseName() instead, as explained in this answer to Base address of exe?

Remy Lebeau0
Related