c# - Application.exe + 000000 读取内存

Question

如您所见，我在获取 .exe 基地址时遇到了一些麻烦。

在这种情况下，假设是 Tutorial-x86_64.exe

如何获取进程地址？

希望任何人都可以提供帮助。

标签： c#cheat-engine

Answer 1

System.Diagnostics.Process[] processes = System.Diagnostics.Process.GetProcessesByName("Tutorial-x86_64"); 

int base = processes[0].MainModule.BaseAddress.ToInt32(); 

您还可以获得入口点

int base_adr = processes[0].MainModule.EntryPointAddress.ToInt32();
int height_offset = 0x0007E1BC; //some address example

int height_adr = (IntPtr)(base_adr + height_offset); 

这是另一个功能。

   private static IntPtr GetModuleBaseAddress(string AppName, string ModuleName) 
    { 
        IntPtr BaseAddress = IntPtr.Zero; 
        Process[] myProcess = null; 
        ProcessModule myProcessModule = null; 

        myProcess = Process.GetProcessesByName(AppName); 

        if (myProcess.Length > 0) 
        { 
            ProcessModuleCollection myProcessModuleCollection; 

            try 
            { 
                myProcessModuleCollection = myProcess[0].Modules; 
            } 
            catch { return IntPtr.Zero; /*Maybe would be ok show the exception after/instead return*/ } 

            for (int i = 0; i < myProcessModuleCollection.Count; i++) 
            { 
                myProcessModule = myProcessModuleCollection[i]; 
                if (myProcessModule.ModuleName.Contains(ModuleName)) 
                { 
                    BaseAddress = myProcessModule.BaseAddress; 
                    break; 
                } 
            } 
        } 

        return BaseAddress; 
    }