Trainermodul problem auf Prozess 64Bit

[Xiantrius]

Du meinst sicherlich HProcess auf UInt64 stellen, wenn es sich um ein 64 Bit Prozess handelt oder?
Das habe ich gemacht und trotzdem kommt nur der Wert 0 raus bei höheren Ziel Adressen.

Visual Basic Code

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As SByte, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As SByte        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As Byte, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Byte        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As Int16, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Int16        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As UInt16, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As UInt16        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As Int32, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Int32        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As UInt32, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As UInt32        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As Int64, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Int64        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As Single, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Single        Private Declare Function RPM Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As UInt64, ByVal lpBaseAddress As Int64, ByRef lpBuffer As Double, ByVal nSize As Int32, ByRef lpNumberOfBytesWritten As Int32) As Double

---

Damit das bisschen veranschaulicht ist hab ich eine Listbox gemacht und möchte euch den Code posten wie ich das ausführe als kleines beispiel und ein Screenshot meiner Form zeigen wie es aussieht.

Visual Basic Code

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

Private Function DoesProcessExists(ByVal PName As String) As Boolean         Return System.Diagnostics.Process.GetProcessesByName(PName).Length >= 1     End Function     Public Const ProcName = "7DaysToDie"     Dim BaseAddress_EXE As Int64     Dim BaseAddress_DLL As Int64     Public Function Does7DaysToDie_EXE(ByVal Test As Boolean) As Boolean         BaseAddress_EXE = GetModuleBase_64Bit(ProcName, ProcName & ".exe")         GetProcessId(ProcName)         Return BaseAddress_EXE     End Function     Public Function Does7DaysToDie_DLL(ByVal Test As Boolean) As Boolean         BaseAddress_DLL = GetModuleBase_64Bit(ProcName, "mono.dll")         GetProcessId(ProcName)         Return BaseAddress_DLL     End Function     Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click         If DoesProcessExists("7DaysToDie") = True Then             BaseAddress_EXE = GetModuleBase_64Bit(ProcName, ProcName & ".exe")             GetProcessId(ProcName)             ListBox1.Items.Clear()             ListBox1.Items.Add("Processname:" & ProcName)             ListBox1.Items.Add("ProcessID:" & GetProcessId(ProcName))             Dim TestexeAddresse As Int64 = GetModuleBase_64Bit(ProcName, "7DaysToDie.exe")             ListBox1.Items.Add("Process Adresse:" & Hex(TestexeAddresse))             Dim TestdllAddresse As Int64 = (GetModuleBase_64Bit(ProcName, "mono.dll"))             ListBox1.Items.Add("Process Adresse + DLL:" & Hex(TestdllAddresse))             Dim Zieladresse32Bit As Int32 = &H7FFF3FEF             ListBox1.Items.Add("Ist noch in den 32Bit Hexadresse=7FFF3FEF: Wert=" & Read_8Byte_Int64(Zieladresse32Bit))             Dim Zieladresse64Bit As Int64 = &H80000002             ListBox1.Items.Add("Ist schon über den 32Bit limit Hexadresse=80000002: Wert=" & Read_8Byte_Int64(Zieladresse64Bit))         End If     End Sub

---

Ihr seht die Process Adresse wird ausgelesen, genauso die ID des Prozesses und eine DLL die eine sehr lange Hexzahl als Adresse hat. Ich weis nur nicht warum es bei direkten adressen immer Wert 0 ergibt wenn diese dann über die 32Bit schwelle kommen das selbe problem habe ich auch wenn es um eine Pointeradresse mit Offsets geht die eine Zieladresse anvisieren sollen da kommt der Wert ebenfalls auf 0.
HProcess habe ich auf UInt64 gemacht.

Nun weis ich auch warum es bei mir mal zufällig ging, weil er mal Adressen im Pointer als Ziel genommen hat die in der 32Bit schwelle waren. Bei mein kollegen war das dann halt immer Pech, bis es mich dann getroffen hat. Nun weis ich es...

Nur ich weis nicht was man an den Trainermodul noch ändern soll.