First for all have NP,GPK and other protection engine, CE looks like will be killed
So write a pseudo-code algorithm that automatically queries the memory base address to prevent forgetting.
DWORD _begin = 0x40000000; For 32-bit
DWORD _end = 0x7FFFFFFF;
DWORD _offset = 0;
DWORD _OFFSETDP = 0xFF;
DWORD targetAddress = 0xBBBBB;
for (DWORD i = _begin; I <= _end;i++)
{
for (_offset = 0;k < _offsetdp;_offset++)
{
DWORD _address = readmemory (_begin + i);
DWORD _add2 = readmemory (_address + _offset);
if (targetAddress = = _add2 | | _address = = targetAddress)
{
Prinf ("Base:%x offset:%x", (_begin + i), _offset);
}
}
}
For multi-level offset, you only need to extend the number of recursion, you need to write the algorithm in detail, do not use multithreading or locks may crash
Please adjust your own mistakes, especially in other languages.
"Original" Memory pointer base address query algorithm