How to read a pointer from the memory of another process?

Question

Programming

Hello, with the help of ArtMoNey I found a pointer to a pointer. And here's the problem I'm reading the data like this

ReadProcessMemory(process, (LPCVOID)0x006C1D48, &p1, 4, NULL);

I can't figure out how to read the pointer.
Here is a screenshot of the window with ArtMoNey. As I understand it, 0x006C1D48 is the address where the pointer 0x00AC1D48 lies, if we add offset + 3060 to it, we get the address of another pointer 0x00C00BF4 if we add offset +200 to it, then we get the address I need 0x2E947868. Tell me how to proceed, otherwise I'm confused.
ReadProcessMemory if you immediately transfer the address 0x2E947868 to it, then everything works fine.

Answer 1

Stop spouting questions. The answer to them will not fit on a dozen pages. Read better about memory addressing, what is an absolute address, relative, what is the base address of the process, what is the randomization of the base address. Just take and read the memory will not work.
1. This address only works for the current process.
2. Secondly, it will be different every time it starts and allocates memory from the heap.
3. It can also change due to ASLR
. To get to the bottom of the actual data structure with character information, you need to find the place in the code where this structure is allocated on the heap. That is, there should be something like

CharInfo info = new CharInfo();
(_thiscall) CharInfo::CharInfo(info)

You need to find this piece of code, the only way you can determine the static place, from where you will later dance. To search for code, you need to know at least the basics of Assembler. The IDA Pro decompiler with the Hex-Rays plugin will help with this.
But these places can be not one, but tens and hundreds in the case of template classes and functions. Here you already need a debugger to set breakpoints for reading or writing memory, and start from them.
You won’t achieve anything by ordinary reading from memory, in order to go through the call chain with the required address, you need to implement your code into the game client yourself, or use frameworks for dynamic instrumentation, for example, DynamoRIO, Intel PIN, Frida.
It is better to conduct tests on a pirate, because the official client can ban for such actions.
By the way, you can start with Ricardo Narvaja's course "Introduction to cracking from scratch using OllyDbg". This is a huge course of articles that covers everything you need to understand the basics. There are 50-something chapters of varying complexity, google it. There is also a whole playlist on YouTube with videos of this course.

Answer 2

ArtMoney is not enough to write a full-fledged runtime patch. You will need a full-fledged debugger, reading and understanding code fragments that are responsible for reading / writing this value.
I can predict the problem you'll run into when trying to discover a (supposedly existing) chain of pointers - every time you run that value (and all pointers to it) it will appear at a new address.

spoiler

Ибо не все так просто.

Answer 3

They would have mastered debuggers and other existing tools for analyzing the structure of process memory before writing a "bicycle", and maybe instead.
And it's interesting that you even want to write this, with reading from the memory of a "foreign" process?