#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>
#include <tchar.h>
#include <psapi.h>
using namespace std;
DWORD GetProcId(const wchar_t* procname)
{
PROCESSENTRY32 pe;
HANDLE hSnap;
pe.dwSize = sizeof(PROCESSENTRY32);
hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (Process32First(hSnap, &pe)) {
do {
if (wcscmp(pe.szExeFile, procname) == 0)
break;
} while (Process32Next(hSnap, &pe));
}
return pe.th32ProcessID;
}
DWORD get_module(DWORD processID, const wchar_t* name)
{
HMODULE hMods[1024];
HANDLE hProcess;
DWORD cbNeeded;
unsigned int i;
// Print the process identifier.
printf("\nProcess ID: %u\n", processID);
// Get a handle to the process.
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, processID);
if (NULL == hProcess)
return 1;
// Get a list of all the modules in this process.
if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
{
for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++)
{
TCHAR szModName[MAX_PATH];
// Get the full path to the module's file.
//GetModuleBaseName(hProcess, hMods[I], szModName, sizeof(szModName) / sizeof(TCHAR))
if (GetModuleBaseName(hProcess, hMods[I], szModName, sizeof(szModName) / sizeof(TCHAR)))
{
if (wcscmp(szModName, name) == 0) return (DWORD)hMods[I];
}
}
}
// Release the handle to the process.
CloseHandle(hProcess);
return 0;
}
int main() {
DWORD pID = GetProcId(L"gta_sa.exe");
std::cout << "pid:" << pID << endl;
HANDLE pGta = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
DWORD pSamp = (DWORD)get_module(pID, L"samp.dll");
DWORD cPed;
ReadProcessMemory(pGta, (LPCVOID)(0x0 + 0xB6F5F0), &cPed, 4, 0);
short skinID;
ReadProcessMemory(pGta, (LPCVOID)(cPed + 0x22), &skinID, 2, 0);
cout << skinID << endl;
std::cout << "samp.dll addr: " << hex << pSamp << endl;
//char nickname[24];
//ReadProcessMemory(pGta, (LPCVOID)(pSamp + 0x26E03F), &nickname, 24, 0);
//MessageBoxA(NULL, nickname, "debug", MB_OK);
//std::cout << nickname << endl;
DWORD dwAddress;
ReadProcessMemory(pGta, (LPCVOID)(pSamp + 0x21A0F8), &dwAddress, 4, 0);
std::cout << "dwAdress : " << hex << dwAddress << endl;
ReadProcessMemory(pGta, (LPCVOID)(dwAddress + 0x3CD), &dwAddress, 4, 0);
std::cout << "dwAdres : " << hex << dwAddress << endl;
DWORD dwPlayers;
ReadProcessMemory(pGta, (LPCVOID)(dwAddress + 0x18), &dwPlayers, 4, 0); //stPlayerPool
std::cout << "dwPlayers : " << dwPlayers << endl;
std::cout << endl << endl;
uint32_t ulMaxPlayerID;
ReadProcessMemory(pGta, (LPCVOID)(dwPlayers), &ulMaxPlayerID, sizeof(uint32_t), 0); //ulMaxPlayerID
std::cout << "ulMaxPlayerID : " << dec << ulMaxPlayerID << endl;
uint16_t sLocalPlayerID;
ReadProcessMemory(pGta, (LPCVOID)(dwPlayers + sizeof(uint32_t)), &sLocalPlayerID, sizeof(uint16_t), 0); //sLocalPlayerID
std::cout << "sLocalPlayerID : " << dec << sLocalPlayerID << endl;
//0x2E
for (int i = 0; i < ulMaxPlayerID; i++)
{
DWORD pRemotePlayer;
ReadProcessMemory(pGta, (LPCVOID)(dwPlayers + 0x2E + i*4), &pRemotePlayer, 4, 0);
if (pRemotePlayer == 0) continue;
//cout << "pRemotePlayer : " << pRemotePlayer << endl;
uint32_t score;
uint32_t ping;
ReadProcessMemory(pGta, (LPCVOID)(pRemotePlayer + 0x24), &score, 4, 0);
ReadProcessMemory(pGta, (LPCVOID)(pRemotePlayer + 0x28), &ping, 4, 0);
uint32_t name_len;
char name[26] = { "" };
ReadProcessMemory(pGta, (LPCVOID)(pRemotePlayer + 0x1C), &name_len, 4, 0);
if (name_len <= 0xf)
{
ReadProcessMemory(pGta, (LPCVOID)(pRemotePlayer + 0xC), &name, 16, 0);
}
else
{
DWORD pName;
ReadProcessMemory(pGta, (LPCVOID)(pRemotePlayer + 0xC), &pName, 4, 0);
ReadProcessMemory(pGta, (LPCVOID)pName, &name, 25, 0);
}
cout << "name : " << name << endl;
cout << "score : " << dec << score << endl;
cout << "ping : " << dec << ping << endl << endl;
}
}
