How to write process memory with multilevel pointer with c++? - c++

Question

I'm trying to make a cheat for RE2. I found memory's with pointer-scan with cheat engine. My code is not working :(
#include <iostream>
#include <windows.h>
using namespace std;
int main() {
int newValue = 10 ;
HWND hwnd = FindWindowA(NULL, "RESIDENT EVIL 2");
if ( hwnd == NULL )
{
cout << endl << "Process handle not found !" << endl;
return 0 ;
} else {
DWORD pId;
GetWindowThreadProcessId(hwnd, &pId);
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId);
if(!hProc) {
cerr << "Cannot open process !" << endl ;
} else {
int c = WriteProcessMemory(hProc, (LPVOID)0x707B6D0 + 0x80 + 0x78 + 0x98 + 0x50 + 0x18, &newValue, (DWORD)sizeof(newValue), NULL);
if (c>0) {
clog << "yes" << endl ;
} else {
clog << "no" << endl ;
}
CloseHandle(hProc);
}
}
return 0;
}

Answer 1

You are misinterpreting what Cheat Engine is showing you.
In your code, 0x707B6D0 + 0x80 + 0x78 + 0x98 + 0x50 + 0x18 equals 0x707B8C8, which is NOWHERE even close to the value of 0x0EC1A3F0 that you are trying to reach.
What you need to do instead is:
First, read a pointer that is stored at the base address 0x707B6D0 (the value read is 0x128BFBB0).
Then, add 0x18 to that pointer (0x128BFBB0 + 0x18 = 0x128BFBC8) and read a new pointer at that address (the value read is 0x128564D0).
Then, add 0x50 to that pointer (0x128564D0 + 0x50 = 0x12856520) and read a new pointer at that address (the value read is 0x0F2EC940).
Then, add 0x98 to that pointer (0x0F2EC940 + 0x98 = 0x0F2EC9D8) and read a new pointer at that address (the value read is 0x0F2EB2B0).
Then, add 0x78 to that pointer (0x0F2EB2B0 + 0x78 = 0x0F2EB328) and read a new pointer at that address (the value read is 0x0EC1A370).
Then, add 0x80 to that pointer (0x0EC1A370 + 0x80 = 0x0EC1A3F0), and write your data to that address.
Try something more like this:
#include <iostream>
#include <stdexcept>
#include <memory>
#include <windows.h>
DWORD_PTR readPointerFromProc(HANDLE hProc, DWORD_PTR baseAddr)
{
DWORD ptr;
if (!ReadProcessMemory(hProc, reinterpret_cast<LPVOID>(baseAddr), &ptr, sizeof(ptr), NULL);
throw std::runtime_error("Cannot read from process !");
return ptr;
}
void WriteIntToProc(HANDLE hProc, DWORD_PTR baseAddr, int value)
{
if (!WriteProcessMemory(hProc, reinterpret_cast<LPVOID>(baseAddr), &value, sizeof(value), NULL);
throw std::runtime_error("Cannot write to process !");
}
struct HandleDeleter
{
typedef HANDLE pointer;
void operator()(HANDLE handle) const { CloseHandle(handle); }
};
int main()
{
int newValue = 10;
try
{
HWND hwnd = FindWindowA(NULL, "RESIDENT EVIL 2");
if (!hwnd)
throw std::runtime_error("Process window not found !");
DWORD pId = 0;
GetWindowThreadProcessId(hwnd, &pId);
HANDLE hProc = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, pId);
if (!hProc)
throw std::runtime_error("Cannot open process !");
std::unique_ptr<HANDLE, HandleDeleter> hProc_deleter(hProc);
DWORD_PTR ptr = readPointerFromProc(hProc, 0x707B6D0);
ptr = readPointerFromProc(hProc, ptr + 0x18);
ptr = readPointerFromProc(hProc, ptr + 0x50);
ptr = readPointerFromProc(hProc, ptr + 0x98);
ptr = readPointerFromProc(hProc, ptr + 0x78);
writeIntToProc(hProc, ptr + 0x80, newValue);
}
catch (const std::exception &e)
{
std::cerr << e.what() << std::endl;
return 0;
}
std::cout << "Success !" << std::endl;
return 0;
}

Answer 2

You need to de-reference between each offset so that you are following the pointer chain. Just adding the offsets is not enough.
Here is a function that does this for you, please keep in mind there is no error checking:
uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets)
{
uintptr_t addr = ptr;
for (unsigned int i = 0; i < offsets.size(); ++i)
{
ReadProcessMemory(hProc, (BYTE*)addr, &addr, sizeof(addr), 0);
addr += offsets[i];
}
return addr;
}
Calling the function would look like:
uintptr_t ammoAddr = FindDMAAddy(hProcess, dynamicPtrBaseAddr, { 0x374, 0x14, 0x0 });
It does not de-reference the last offset, which is ideal.
After that, call WriteProcessMemory using the return from that function as the lpBaseAddress argument.