My "loop through memory" doesnt recognis

circle back to where someone explained that floating point is hard to compare.
you can skip that byte, rather than force zero...

memcmp( ((char*)p)+1, &((char*)valToFind)+1, sizeof(valToFind)-1)
check the +1s etc but roughly like that.

Is the actual address of found "double" value is p variable? What should I do to pass it into mem.write function? Isnt "address" sth like int?

memcmp( ((char*)p)+1, &((char*)valToFind)+1, sizeof(valToFind)-1)

Cannot case from type 'double' to pointer type 'char *'

So I did it like this:

char* xptr = (char*)(&valToFind);

if ( memcmp (((char *) p) +1, &xptr +1, sizeof (valToFind) -1) == 0 ) {

Is it good too?
And what address should I pass to mem.write function?

Last edited on

yea you got the idea, just have to cast whatever things to byte blocks (char *).

you should keep what you had for mem.write. It presumably writes the correct block over the old value. All the memcmp does is skip one byte, which you said was not matching. This may not be correct thing to do, but you can test the heck out of it to see if it works as you need it to.

Last edited on

mem.write(start, d_Y);

Isnt it write only start address / entire memory block? If I remember correctly I got crashed with this

what are you trying to write, and where? are you over-writing ONE double? Then the number of bytes you need to change are "sizeof(double)", and where is &variable or some pointer location etc that you got from where you found what to change. And what you change it to appears to be a constant. Look at what the .write() takes as parameters -- there may be a variety of overloads for it, with varying parameters -- and put those things into it so that it writes what you want where you want it. I looked but never found a 'memory' object so I don't know what the parameter options are... but it should be really simple once you check what you feed it.

Start no longer points to the value you want to change.

    valToFind = d_Y + playerHeight;
    len = end - start;
    for(start; start < end; start += oneMb){
        unsigned long bsize = len > oneMb ? oneMb : len;
        unsigned char *ptr = mem.getPointer(start,bsize);
        for ( offset = 0 ; offset < bsize ; offset += sizeof(double) ) {
            if ( memcmp(&ptr[offset], &valToFind, sizeof(valToFind)) == 0 ) {
                mem.write(start+offset, d_Y);
                std::cout << "Value found at: " << std::hex << "0x" << std::uppercase << (start+offset) << std::endl;
            }
       }
        delete [] ptr;
    }

^ I will check it

    template <typename T>
    void write(QWORD dwAddress, T value){
        WriteProcessMemory(hProcess, (LPVOID)dwAddress, &value, sizeof(T), 0);
    }

I want to replace found double values with choosen values (valToFind variable). So I have to write my double to address where the value is found.

write function need address. Is it possible to get address of wanted double from this memory block? (this address should be equal to double variable address in targeted program)

Like, find double valToFind variable and overwrite it with d_Y variable

Last edited on

Double recognision dont work, even with this flag. Address when this value is got found, Tried to do sth like this:

if ( memcmp (((char *) p) +1, &xptr +1, sizeof (valToFind) -1) == 0 ) {

and got sth like this:

if ( memcmp(&ptr[offset]+1, &valToFind+1, sizeof(valToFind)-1) == 0 ) {

but with this every address is falsely correct..

btw, when I said only first byte is incorrect, I checked it this way: calculated d_Y + playerHeight in Windows Calculator (got "identical" number), pasted it as value in address to find, and just checked it's bytes in "Browse this memory region" in CE.

Last edited on

> if ( memcmp(&ptr[offset]+1, &valToFind+1, sizeof(valToFind)-1) == 0 ) {
&valToFind+1 isn't the 2nd byte inside the variable valToFind, it's sizeof(valToFind) bytes away.

    valToFind = d_Y + playerHeight;
    unsigned char *valPtr = reinterpret_cast<unsigned char *>(&valToFind);
    len = end - start;
    for(start; start < end; start += oneMb){
        unsigned long bsize = len > oneMb ? oneMb : len;
        unsigned char *ptr = mem.getPointer(start,bsize);
        for ( offset = 0 ; offset < bsize ; offset += sizeof(double) ) {
            if ( memcmp(&ptr[offset]+1, valPtr+1, sizeof(valToFind)-1) == 0 ) {
                mem.write(start+offset, d_Y);
                std::cout << "Value found at: " << std::hex << "0x" << std::uppercase << (start+offset) << std::endl;
            }
       }
        delete [] ptr;
    }

Still it cant recognise value what I want to find :(

Maybe sth with this?

btw, when I said only first byte is incorrect, I checked it this way: calculated d_Y + playerHeight in Windows Calculator (got "identical" number), pasted it as value in address to find, and just checked it's bytes in "Browse this memory region" in CE.

Or how can I check (printable way) my calculated double aob?

byte* array = (byte*)&valToFind;

got weird char with this when tried to print it in any way

Last edited on

Perhaps you should post your actual latest code.

Posting random lines and "it doesn't work" isn't helping us figure out what you're doing wrong.

Oh wait, I was sleepy af when testing it, or it just didnt work (working now). I will test it few more times for sure.

Yeah, working now BUT, due to it's "inaccuracy" (probably cuz of this one byte?) got multiple values, and sometimes got crash (in target app). Which way will be better to improve accuracy of this? Fixing this one byte or save those addresses where value got found and rescan it (with changed value)? With this rescan I can do sth, but with this byte I need some help (^ post)

#include <iostream>
#include <chrono>
#include <iomanip>
#include "memory.h"
#include <cstring>
#include <vector>
#include <fstream>
#include <cstdlib>
#include <stdlib.h>

Memory mem;

typedef uint64_t QWORD;


QWORD start = 0xC0000000; //0xD2000000
QWORD end = start + 0x26A85000; //0x26A85000;

const double playerHeight = 1.7999999523163;
double d_Y = 0;
double findValue = 0;
double valToFind = 0;

int main()
{

    std::cout << "Your height value? ";
    std::cin >> d_Y;

    auto t1 = std::chrono::high_resolution_clock::now();

    valToFind = d_Y + playerHeight;

    unsigned long len = end - start;
    unsigned long oneMb = 1024 * 1024;

    unsigned char *valPtr = reinterpret_cast<unsigned char *>(&valToFind);

    std::cout << std::hex << (static_cast<char*>(static_cast<void*>(&valToFind))) << std::endl;

    for(start; start < end; start += oneMb){
        unsigned long bsize = len > oneMb ? oneMb : len;
        unsigned char *ptr = mem.getPointer(start,bsize);
        for ( int offset = 0 ; offset < bsize ; offset += sizeof(double) ) {
            //if(start+offset == 0xDDFB28D8) std::cout << "GOT ADDRESS, NO VALUE YET" << std::endl;
            if ( memcmp(&ptr[offset]+1, valPtr+1, sizeof(valToFind)-1) == 0 ) {
                mem.write(start+offset, d_Y);
                std::cout << "Value found at: " << std::hex << "0x" << std::uppercase << (start+offset) << std::endl;
            }
       }
        delete [] ptr;
    }
    auto t2 = std::chrono::high_resolution_clock::now();
    auto duration = std::chrono::duration_cast<std::chrono::seconds>( t2 - t1 ).count();
    std::cout << std::endl << std::dec << duration;

    std::getchar();
    std::getchar();
    return 0;
}

unsigned char* Memory::getPointer(QWORD address, long Value)
{
    unsigned char *buff = new unsigned char[1024*1024];
    ReadProcessMemory(hProcess, (LPVOID)address, buff,Value,0);
    return buff;
}

Last edited on

    for(start; start < end; start += oneMb){
        unsigned long bsize = len > oneMb ? oneMb : len;
        unsigned char *ptr = mem.getPointer(start,bsize);
        for ( int offset = 0 ; offset < bsize ; offset += sizeof(double) ) {
            //if(start+offset == 0xDDFB28D8) std::cout << "GOT ADDRESS, NO VALUE YET" << std::endl;
            double *d = reinterpret_cast<double*>(&ptr[offset]);
            if ( closeEnough(*d,valToFind) ) {
                mem.write(start+offset, d_Y);
                std::cout << "Value found at: " << std::hex << "0x" << std::uppercase << (start+offset) << std::endl;
            }
       }
        delete [] ptr;
    }

    
// return true if target is within some tolerance of the reference
// http://c-faq.com/fp/fpequal.html
bool closeEnough(double target, double reference) {
  double lowerBound = reference - reference / 10;  // might need attention for negative values.
  double upperBound = reference + reference / 10;
  // remove differences that are out of the ball park
  if ( target < lowerBound || target > upperBound )
    return false;
  // both are similar, but read the FAQ
  // If you start looking for numbers massively different to 
  // 1e0 to 1E3, then the tolerance will need attention
  return fabs(target - reference) < 0.001;
}

Thank you for activity in entire post,

return fabs(target - reference) < 0.0000001;

with this tolerance no crash and probably best time (~7seconds).

I will mark it as solved in one day, maybe someone have an idea how to speed it up little bit more :D