Search code examples
c#intptr

Pointer address of intptr


Sorry for asking this silly question but I'm trying to get a address (pointer) of a lib running in a remote process.

The address is saved in type intptr but when i print the value i get a huge int.

How can i convert it into 0x00000 etc?

Example code:

    public uint GetModuleBase(string _moduleName)
    {
        MODULEENTRY32 me32 = new MODULEENTRY32();
        IntPtr hSnapshot = IntPtr.Zero;

        me32.dwSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(me32);
        hSnapshot = CreateToolhelp32Snapshot(0x00000008, this.processId);

        // can we start looking?
        if (!Module32First(hSnapshot, ref me32))
        {
            CloseHandle(hSnapshot);
            return 0;
        }

        // enumerate all modules till we find the one we are looking for 
        // or until every one of them is checked
        while (String.Compare(me32.szModule, _moduleName) != 0 && Module32Next(hSnapshot, ref me32))
        {
            modules.Add(me32.szModule, me32.modBaseAddr);
        }

        // close the handle
        CloseHandle(hSnapshot);

        // check if module handle was found and return it
        if (String.Compare(me32.szModule, _moduleName) == 0)
        {
            return (uint)me32.modBaseAddr;
        }
        return 0;
    }

Process hacker shows that the lib is loaded at address (0x6f300000) but i get a int value (1865416704) when i try to print the intptr value.


Solution

  • You can convert your integer number to 0x00000000 format (which is just a hexadecimal representation) by using ToString() and prefixing the 0x part like this:

    int yourNumber = 1234567890;
    string hexNumber = string.Format("0x{0:X}", yourNumber);
    

    However, there's no real need to do this as it's essentially just a display format.