How to get the "Base Address" of the main module of another process

Question

Hello, I made a software that Analyzes the dump of a certain Engine process to extract the XOR key from the game automatically because it has a dynamic 16 bytes XOR changing from compilation to compilation of the game... And to translate games from this engine I need to decrypt your files.

Currently I analyze a dump done by Processdump and the same to dumpar a process leaves in the file name the "Base Address" of the dumpado module.

I wanted to know how I prune in C# a way compatible with x86 and x64 to take the "Base Address" of a process without having to dump it... after all the class Process can not say to me the Base Address, always crashes when I try.

I learned yesterday of a Library called Memorysharp, will it be that it should be useful to my case?

PS: I accept P/Invoke

Answer 1

Try this:

Process[] processes = Process.GetProcessesByName("meuPrograma"); 
Process mProc = processes[0]; 
IntPtr hProc = mProc.Handle; 

int base_adr = processes[0].MainModule.EntryPointAddress.ToInt32(); 
int height_offset = 0x0007E1BC; 
height_adr = (IntPtr)(base_adr + height_offset); 

ckFreezeFlag.Text = "Base: " + base_adr.ToString("X"); 
ckFreezeMines.Text = "Height: " + height_adr.ToString("X");

Keep in mind that the call mProc = processes[0]; may not have a completed result, so it may cause an error, you should test if it is empty.

The offset is on your own ;)