Sorry for asking this silly question but I'm trying to get a address (pointer) of a lib running in a remote process.
The address is saved in type intptr but when i print the value i get a huge int.
How can i convert it into 0x00000 etc?
Example code:
public uint GetModuleBase(string _moduleName)
{
MODULEENTRY32 me32 = new MODULEENTRY32();
IntPtr hSnapshot = IntPtr.Zero;
me32.dwSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(me32);
hSnapshot = CreateToolhelp32Snapshot(0x00000008, this.processId);
// can we start looking?
if (!Module32First(hSnapshot, ref me32))
{
CloseHandle(hSnapshot);
return 0;
}
// enumerate all modules till we find the one we are looking for
// or until every one of them is checked
while (String.Compare(me32.szModule, _moduleName) != 0 && Module32Next(hSnapshot, ref me32))
{
modules.Add(me32.szModule, me32.modBaseAddr);
}
// close the handle
CloseHandle(hSnapshot);
// check if module handle was found and return it
if (String.Compare(me32.szModule, _moduleName) == 0)
{
return (uint)me32.modBaseAddr;
}
return 0;
}
Process hacker shows that the lib is loaded at address (0x6f300000) but i get a int value (1865416704) when i try to print the intptr value.
You can convert your integer number to 0x00000000
format (which is just a hexadecimal representation) by using ToString()
and prefixing the 0x
part like this:
int yourNumber = 1234567890;
string hexNumber = string.Format("0x{0:X}", yourNumber);
However, there's no real need to do this as it's essentially just a display format.