Solved Memory Address - Not in a module [Screenshot Provided]

Hexui Undetected CSGO Cheats Sinkicheat PUBG Cheat

Aleksander

Newbie
Full Member
May 10, 2015
12
152
0


Should be pretty self explanatory, here we see an address of "0289A7F0". When we look for modules in the process, the closest is libpng12 (dll) which has a base of 2080000 and a size of 26000. My address does not fit in this module range so when we look further down, the next module starts at 8B60000, which is way off.

TL;DR: Which module does my address belong to?

Edit: Also whatever the pattern scanner is finding, it's telling us that the module it's in has a base of 2890000 and a size of 10000. As you see, I can't find a module with that base (hence "Unknown module or file"). Also tried a few other debuggers with the same result.

Thanks for the help.
 
Last edited:

mambda

headass
Escobar Tier VIP
Trump Tier Donator
Jun 25, 2014
2,298
37,938
269
It doesn't "Belong" to any module, it's allocated memory. it could have been placed at any address
 

Aleksander

Newbie
Full Member
May 10, 2015
12
152
0
So to scan for such an address, would I scan the entire memory region of the process (excluding known module ranges)?
 

Rake

Cesspool Admin
Administrator
Jan 21, 2014
12,153
78,998
2,396
2890000 and a size of 10000. As you see, I can't find a module with that base (hence "Unknown module or file")
2890000 = 0x2C1910 in hex

2890000 does not equal 0x2890000 because the 0x denotes it as hex so use proper hex values while doing your scan

I'm curious what are you doing?
 

Aleksander

Newbie
Full Member
May 10, 2015
12
152
0
Well I was using 2890000 as an example because that is the result from the sig maker from the screenshot above, point taken though. Regardless, the main issue is that the address not found in a module range. With that said, what would be the best way to scan for an address not in a module?

Edit: I'm working on an external AOB/Pattern scanner.
 

mambda

headass
Escobar Tier VIP
Trump Tier Donator
Jun 25, 2014
2,298
37,938
269
I've got some old code here if that's alright

C++:
	MEMORY_BASIC_INFORMATION mbi;
	DWORD curPos = 0;
	DWORD dwCmp = 0;
	while (curPos < moduleSize)
	{
		VirtualQueryEx(procHandle, (void*)(hModule + curPos), &mbi, sizeof(mbi));
		char * readMemory = new char[mbi.RegionSize];
		unsigned long bytesRead;
		ReadProcessMemory(procHandle, mbi.BaseAddress, readMemory, mbi.RegionSize, &bytesRead);
		dwCmp = FindPattern((DWORD)readMemory, mbi.RegionSize, (PBYTE)"\xF6\x45\x0C\x02\x74\x07", "xxxxxx");
		if (dwCmp)
		{
			printf("Found ya!\n");
			dwCmp -= (DWORD)readMemory;
			dwCmp += curPos;
			DWORD old = 0;
			unsigned char toWrite[] = { 0x90,0x90,0x90,0x90, 0x90, 0x90 , 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
			if (VirtualProtectEx(procHandle, (void*)(hModule + dwCmp), sizeof(toWrite) , PAGE_EXECUTE_READWRITE, &old))
			{
				if (WriteProcessMemory(procHandle, (void*)(hModule + dwCmp), toWrite, sizeof(toWrite), 0))
				{
					printf("Successful writing!\n");
				}
				VirtualProtectEx(procHandle, (void*)(hModule + dwCmp), sizeof(toWrite), old, 0);
			}
			break;
		}
		memset( readMemory , 0 , sizeof( readMemory ) );
		delete[] readMemory;
		curPos += mbi.RegionSize;
	}
 
Attention! Before you post:

Read the How to Ask Questions Guide
99% of questions are answered in the Beginner's Guide, do it before asking a question.

No Hack Requests. Post in the correct section.  Search the forum first. Read the rules.

How to make a good post:

  • Fill out the form correctly
  • Tell us the game name & coding language
  • Post everything we need to know to help you
  • Ask specific questions, be descriptive
  • Post errors, line numbers & screenshots
  • Post code snippets using code tags
  • If it's a large project, zip it up and attach it

If you do not comply, your post may be deleted.  We want to help, please make a good post and we will do our best to help you.

Community Mods