https://github.com/baratgabor/processutils32

Utility class for 32 bit processes that can get their ThreadStack0, and follow pointer chains in their virtual address space to read a final value into a chosen type.
https://github.com/baratgabor/processutils32

cheatengine csharp-code dotnet pinvoke pointer pointer-chains threadstack0

Last synced: about 1 month ago
JSON representation

Utility class for 32 bit processes that can get their ThreadStack0, and follow pointer chains in their virtual address space to read a final value into a chosen type.

• Host: GitHub
• URL: https://github.com/baratgabor/processutils32
• Owner: baratgabor
• Created: 2018-01-15T17:51:13.000Z (almost 7 years ago)
• Default Branch: master
• Last Pushed: 2018-01-15T18:16:51.000Z (almost 7 years ago)
• Last Synced: 2024-01-29T13:41:43.381Z (11 months ago)
• Topics: cheatengine, csharp-code, dotnet, pinvoke, pointer, pointer-chains, threadstack0
• Language: C#
• Homepage:
• Size: 13.7 KB
• Stars: 9
• Watchers: 1
• Forks: 1
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
## ProcessUtils32

Simple utility class that uses various PInvoke functions to read information from the virtual address space of other processes. 

**Compatible only with 32 bit processes. NOTE that all methods are public, but the majority of them don't do bitness checks.**

Main features:

- Getting the address of the elusive **ThreadStack0** symbol used by CheatEngine

- Following pointer chains, and reading a result into a chosen type

I'll probably convert it sometime to use unsafe code and pointers, plus I'll write a 64 bit equivalent.

*I used this class to read data from an app that was written in an unintentionally cryptic way, lacking any interop capabilities, and being completely inaccessible by UIA and MSAA.*