Solved What is the fastest way to get module base address?

Hexui Undetected CSGO Cheats Sinkicheat PUBG Cheat

iPower

Piece of shit
Moderator
Escobar Tier VIP
Fleep Tier Donator
Jun 29, 2017
593
21,108
67
I'm doing some internal hacks and i need to know if there are other methods to get base address module instead of the CreateToolHelp32Snapshot. Can you guys please give me one? I couldn't find anything about this here. Thanks!
 
  • Like
Reactions: Elitiok

Traxin

Escobar Tier VIP
Dank Tier Donator
Aug 3, 2015
1,041
25,378
154
One more doubt: is uintptr_t like a pointer to unsigned int?
Hex provided a great and very thorough answer, however, I'd like to add to it a simple breakdown.
In the most simplest terms, uintptr_t is basically a variable type that will always be the size of a pointer (void* for example).
Whether the application is built as a 32bit application or a 64bit application will determine the size of a pointer, and therefore the size of uintptr_t.
Most common implementations dictates it will either be 4 bytes wide, or 8 bytes wide, respectively.

The main issue here is that you can't really do integer arithmetic on a simple pointer type. So you can't add an offset to a void*, it just doesn't work.
So what we do is simply cast the pointer into an integer type to be able to work with it and modify it. Then you'll just cast it back into a pointer whenever you need to.
 

iPower

Piece of shit
Moderator
Escobar Tier VIP
Fleep Tier Donator
Jun 29, 2017
593
21,108
67
Thanks Traxin! You are such a good person!
 

HexMurder

Arcane Hacker
Dank Tier VIP
Dank Tier Donator
Jun 7, 2012
319
7,988
22
One more doubt: is uintptr_t like a pointer to unsigned int?
"It is an unsigned int that is capable of storing a pointer. Which typically means that it's the same size as a pointer.

It is defined in C++11 and later standards.

A common reason to want an integer type that can hold an architecture's pointer type is to perform integer-specific operations on a pointer, or to obscure the type of a pointer by providing it as an integer "handle"."

source: https://stackoverflow.com/questions/1845482/what-is-uintptr-t-data-type
 

Stricknein

Dank Tier Donator
Aug 14, 2019
23
298
0
C++:
uintptr_t pEngine = (uintptr_t)GetModuleHandle(TEXT("engine.dll"));
Good post for people to understand ways of getting the base address internally. I thought it would be worth adding another option of getting the base address from the FS and DS data segments.

Alt method to get Base Address Internally:
uintptr_t base;

    __asm {
        MOV EAX, DWORD PTR FS : [0x30]
        MOV EAX, DWORD PTR DS : [EAX + 0x8]
        MOV base, EAX
    }
 

Rake

Cesspool Admin
Administrator
Jan 21, 2014
12,140
78,998
2,394
Good post for people to understand ways of getting the base address internally. I thought it would be worth adding another option of getting the base address from the FS and DS data segments.

Alt method to get Base Address Internally:
uintptr_t base;

    __asm {
        MOV EAX, DWORD PTR FS : [0x30]
        MOV EAX, DWORD PTR DS : [EAX + 0x8]
        MOV base, EAX
    }
Interesting, does that get the module address of the main .exe or the module whose code is currently executing?
 

bezier

Full Member
Nobleman
May 28, 2018
111
3,478
5
Interesting, does that get the module address of the main .exe or the module whose code is currently executing?
It only gets the address of the main module unfortunately.

C++:
MOV EAX, DWORD PTR FS : [0x30]      //Get's adress of PEB from TEB
MOV EAX, DWORD PTR DS : [EAX + 0x8] //At offset 0x8 from PEB is void* ImageBaseAddress)
But here is an interesting read which can be used to get address of any loaded module.

edit: Can't have links in code tag. PEB TEB
 
  • Like
Reactions: Rake and Stricknein

Stricknein

Dank Tier Donator
Aug 14, 2019
23
298
0
Interesting, does that get the module address of the main .exe or the module whose code is currently executing?
Ya it get's the main module from the Thread Environment Block structure, and at the offset of 0x30 it is a pointer to the Process Environment Block structure. I havent looked at what else is stored there, just that address to the main module.
 
  • Like
Reactions: Rake

Stricknein

Dank Tier Donator
Aug 14, 2019
23
298
0
It only gets the address of the main module unfortunately.

C++:
MOV EAX, DWORD PTR FS : [0x30]      //Get's adress of PEB from TEB
MOV EAX, DWORD PTR DS : [EAX + 0x8] //At offset 0x8 from PEB is void* ImageBaseAddress)
But here is an interesting read which can be used to get address of any loaded module.

edit: Can't have links in code tag. PEB TEB
Thanks for the link, alot of good information there.
 
  • Like
Reactions: bezier
Attention! Before you post:

Read the How to Ask Questions Guide
99% of questions are answered in the Beginner's Guide, do it before asking a question.

No Hack Requests. Post in the correct section.  Search the forum first. Read the rules.

How to make a good post:

  • Fill out the form correctly
  • Tell us the game name & coding language
  • Post everything we need to know to help you
  • Ask specific questions, be descriptive
  • Post errors, line numbers & screenshots
  • Post code snippets using code tags
  • If it's a large project, zip it up and attach it

If you do not comply, your post may be deleted.  We want to help, please make a good post and we will do our best to help you.

Community Mods