Found the module and offsets in the application using ARTMoney enter image description here

Trying to get this value in myself:

hWnd = FindWindowA(NULL, "Clamp Champ"); GetWindowThreadProcessId(hWnd,&pid); // запоминаем номер в переменную pid if (process == NULL && pid != 0) process = OpenProcess(PROCESS_VM_READ, false, pid); unsigned int val = NULL; unsigned int val1 = NULL; unsigned int val2 = NULL; unsigned int val3 = NULL; ReadProcessMemory(process, (LPCVOID)(GetModuleBase("server.dll", pid )+0x215E950), &val1, 4, NULL); val1 = val1+0x2F8; ReadProcessMemory(process, (LPVOID)(val1), &val2, 4, NULL); val2 = val2+0x18; ReadProcessMemory(process, (LPVOID)(val2), &val3, 4, NULL); this->label1->Text = Convert::ToString(val3);

That's how I get the base address

  DWORD GetModuleBase(LPSTR lpModuleName, DWORD dwProcessId) { MODULEENTRY32 lpModuleEntry = {0}; HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId ); if(!hSnapShot) return NULL; lpModuleEntry.dwSize = sizeof(lpModuleEntry); BOOL bModule = Module32First( hSnapShot, &lpModuleEntry ); while(bModule) { if(!strcmp( lpModuleEntry.szModule, lpModuleName ) ) { CloseHandle( hSnapShot ); return (DWORD)lpModuleEntry.modBaseAddr; } bModule = Module32Next( hSnapShot, &lpModuleEntry ); } CloseHandle( hSnapShot ); return NULL; }

Gives out different values ​​from artmoney! Guys, maybe a fresh look who will find mistakes?

  • one
    There is an assumption that Artmoney gives you VA, and not RVA. 0x215E950 speaks rather in favor of this version: it is unlikely that you have such a large module ... - Vladimir Martyanov
  • The module is really very large, I pick the memory of a popular modern game - Sergo

0