Hi folks!

I'm trying to get base address of a runnig process, but can't make it work.

I know that, most of the times, the base address of a running process is 0x00400000

I don't want to assume that, in case it is not 0x00400000 for a given .exe.

I'm getting two erros in my attempt:
1. The base address is always returning 0x0 in VirtualQueryEX;
2. My .exe is not ending properly.

Could someone please help me?

P.S.: Edit constant "gamename" in .data section. It holds the name of the process i want the base address.

Thanks a lot,
ctl3d32

the VIRTUAL base adress of a process is 400000h.
the paging makes it possible.
and to know exactlly the base adress of a programm, the easy way is to make this:



but to know the real base adress, it is another Q.

psapi can enum modules.

1. attach debugger
2. enum modules
3. do some work
4. detach debugger

Image base, perhaps? This is not set in stone, just a default for historical reasons (IIRC, low 4 MiB area is reserved for MS-DOS compatibility in Win9x): one can easily build PE with preferred load address, ImageBase, being zero; this PE can be successfully loaded if base relocations are present in it. You even don't have to bother with separate linking: take any fasm-compiled PE with base relocations and rebase it anywhere (editbin /rebase:base=base).

----8<----
ctl3d32,

If you won't mind some undocumented functions/structures, NtQueryInformationProcess() can be useful.