Help reading a value with DMA variable

Does anyone have any type of advice for me?

I very much doubt it's DMA - application level code isn't likely to have access to something as low level.
The only way I can see to find the value is to scan memory for it.

What is the variable you're trying to find? And what game?

The game is a small client server type called Space Quest 2009, its one my cousin and his friends have been working on.

The value im trying to read is the inventory ammount of the cargo , in the cargo hold.

Example... In my cargo hold 5x5 compartments... I have in compartment 1 5xUranium, in compartment 2 1xQuartz in compartment 3 17xOrganics

I am trying to make a little 'bot' that will auto trade with a starport. My program needs to be able to know how much 'organics' i am holding.

I scanned the memory, and found the location for the compartments and was able to read how much of each material was in each compartment. I hard coded my 'bot' program, and everything was fine.

Next time I loaded the game (my client side) There was inaccurate values in the previously mapped locations. So I did a search again, and found the cargo hold data but at a new location.

So I exited the game and loaded it again, the cargo hold data was at another new location.

After looking online I thought this might be a case of DMA. So I needed to know more about how to create a program that can 'find' the cargo hold variables without having to search and change values and search again each time i run the program

Thanks

Quote:

Original post by SelethD The game is a small client server type called Space Quest 2009, its one my cousin and his friends have been working on. The value im trying to read is the inventory ammount of the cargo , in the cargo hold. Example... In my cargo hold 5x5 compartments... I have in compartment 1 5xUranium, in compartment 2 1xQuartz in compartment 3 17xOrganics I am trying to make a little 'bot' that will auto trade with a starport. My program needs to be able to know how much 'organics' i am holding.

First, I'd suggest contacting your friend and asking them to make an interface for plugins for bots. I can understand why they might not want to though.

Quote:

Original post by SelethD I scanned the memory, and found the location for the compartments and was able to read how much of each material was in each compartment. I hard coded my 'bot' program, and everything was fine. Next time I loaded the game (my client side) There was inaccurate values in the previously mapped locations. So I did a search again, and found the cargo hold data but at a new location. So I exited the game and loaded it again, the cargo hold data was at another new location. After looking online I thought this might be a case of DMA. So I needed to know more about how to create a program that can 'find' the cargo hold variables without having to search and change values and search again each time i run the program

It's not to do with DMA at all, it's because that's the way dynamic memory allocation works. The game says to the OS "Give me a wodge of memory" and the OS allocates it and returns a pointer - the pointer might not be the same through each run of the game though, and is more likely to vary if anything at all different happens between 2 runs of the game up to the point that the memory is allocated.

The only way I can think of to do this is to write an app to fake keyboard input to the game to add / remove the amount of cargo stored in a slot, and scan the process memory each time. Then you compare the memory snapshots and look for a value that's E.g. 1 when you started, and goes up to 2 when you added an item of cargo.
See "The Cheat Machine" - it's a program that lets you scan through program memory and check for values changing.
However, this isn't guaranteed to work by any means.

Lol, no, I dont want him to know im cheating his little game, :D

I found the code that manipulates the 'ammount' of organics, and the code is always at the same place in memeory. From this code can my bot program get the address?

the address is 7CF091 mov al,[eax+0x11]

So is there a way in c# to access what is in 'eax' (since im assuming eax holds the address offset to the data I seek)

If you're lucky you may find that a pointer to that dynamically allocated data is stored at a fixed location, but it's not always the case. Searching for that pointer shouldn't be too hard though, and you may be lucky.

Edit: EAX is a CPU register that will change very frequently. Reading it won't help, unless you can catch it at exactly the right moment.

Quote:

Original post by Evil Steve The game says to the OS "Give me a wodge of memory" and the OS allocates it and returns a pointer - the pointer might not be the same through each run of the game though, and is more likely to vary if anything at all different happens between 2 runs of the game up to the point that the memory is allocated.

Or if you're running Vista or Windows 7 the OS will automatically randomize allocated memory regions like stack base addresses as part of the security enhancements.

ok, so if I have a static pointer to the 'code' that manipulates the data I seek.... Then what can I do to get the address of the data?

Quote:

Original post by Adam_42 Edit: EAX is a CPU register that will change very frequently. Reading it won't help, unless you can catch it at exactly the right moment.

It won't in this case. eax is pointer to structure holding the data at offset 11h. Probably something like:

struct Foo {  ...  ...  unsigned char value;   ...};

while the code is doing:

Foo * foo = getFooFromSomewhere();unsigned char temp = foo->value; // this is the mov statementtemp += 10;...// and so on...

Quote:

the address is 7CF091 mov al,[eax+0x11]

Where does eax come from? Backtrack to see where it is.

If it's dynamically allocated, then you will need to find where the pointer is stored. If it's in static location, then you simply read the address from there, add 11 and are done with it.

If it's stored dynamically, then it gets trickier, but can be done, you just need to figure out where it's stored. Usually, such values will not get moved around much.

Quote:

So is there a way in c# to access what is in 'eax'

You'll be using Windows API anyway to access process memory, so it doesn't matter which language you are using, as long as you can invoke native API. As said, it's not EAX you are interested in, it's where its value comes from.

ok, eax is holding the value 865A3C4
So I did a search of memory for 865A3C4 (dont know if this is how I find where eax comes from or not)

And I got 1 result at location 866E6F0

So... if im understanding this correctly, the value in 866E6F0 should be a pointer to the data i seek in memory? where does the +11 from "mov al,[eax+0x11]
" come in?

Quote:

Original post by SelethD ok, eax is holding the value 865A3C4 So I did a search of memory for 865A3C4 (dont know if this is how I find where eax comes from or not) And I got 1 result at location 866E6F0 So... if im understanding this correctly, the value in 866E6F0 should be a pointer to the data i seek in memory?

Yes. The pointer is at address 0x0866E6F0, and the pointer's value (the address pointed at) is 0x0865A3C4.

Quote:

Original post by SelethD where does the +11 from "mov al,[eax+0x11]" come in?

As Antheus said, eax probably points to a class or struct, and the +0x11 is to access the variable 0x11 (17) bytes from the start of that struct or class. If eax = 0x0865A3C4 before the mov statement, then that's probably the address of the struct/class, so the member variable is at 0x0865A3C4+0x11 = 0x0865A3D5.