title: How to get process's base address with MODULEENTRY32?
body: <p>I'm looking to do something in this example: <a href="https://stackoverflow.com/questions/13045864/python-how-to-get-the-start-base-address-of-a-process">Python - How to get the start/base address of a process?</a>.  I'm having the same issue as the person in that topic, in that the pointers cheat engine provides is in reference to the base address of the process itself.</p>
  
  <p>I've looked around and it looks like the best solution is to use ctypes and the MODULEENTRY32 to store snapshots of processes and analyze their modBaseAddr.</p>
  
  <p>Here is my current code</p>
  
  <pre><code>import os.path, ctypes, ctypes.wintypes
  from ctypes import *
  from ctypes.wintypes import *
  
  PROCESS_QUERY_INFORMATION = (0x0400)
  PROCESS_VM_OPERATION = (0x0008)
  PROCESS_VM_READ = (0x0010)
  PROCESS_VM_WRITE = (0x0020)
  TH32CS_SNAPMODULE = (0x00000008)
  
  CreateToolhelp32Snapshot= ctypes.windll.kernel32.CreateToolhelp32Snapshot
  Process32First = ctypes.windll.kernel32.Process32First
  Process32Next = ctypes.windll.kernel32.Process32Next
  Module32First = ctypes.windll.kernel32.Module32First
  Module32Next = ctypes.windll.kernel32.Module32Next
  GetLastError = ctypes.windll.kernel32.GetLastError
  OpenProcess = ctypes.windll.kernel32.OpenProcess
  GetPriorityClass = ctypes.windll.kernel32.GetPriorityClass
  CloseHandle = ctypes.windll.kernel32.CloseHandle
  
  class MODULEENTRY32(Structure):
         _fields_ = [ ( 'dwSize' , DWORD ) , 
                  ( 'th32ModuleID' , DWORD ),
                  ( 'th32ProcessID' , DWORD ),
                  ( 'GlblcntUsage' , DWORD ),
                  ( 'ProccntUsage' , DWORD ) ,
                  ( 'modBaseAddr' , POINTER(BYTE)) ,
                  ( 'modBaseSize' , DWORD ) , 
                  ( 'hModule' , HMODULE ) ,
                  ( 'szModule' , c_char * 256 ),
                  ( 'szExePath' , c_char * 260 ) ]
  
  
  
  def GetBaseAddr(ProcId, ProcName):
         me32 = MODULEENTRY32()
         me32.dwSize = sizeof(me32)
         hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, ProcId)
         if GetLastError() != 0:
                CloseHandle(hSnapshot)
                print 'Handle Error %s' % WinError()
                return 'Error'
  
         else:
                if Module32First(hSnapshot, byref(me32)):
                       if me32.szModule == ProcName:
                              CloseHandle(hSnapshot)
                              return id(me32.modBaseAddr)
  
                       else:
                              Module32Next(hSnapshot, byref(me32))
                              while int(GetLastError())!= 18:
                                     if me32.szModule == ProcName:
                                            CloseHandle(hSnapshot)
                                            return id(me32.modBaseAddr)
  
                                     else:
                                            Module32Next(hSnapshot, byref(me32))
  
                              CloseHandle(hSnapshot)
                              print 'Couldn\'t find Process with name %s' % ProcName
  
                else:
                       print 'Module32First is False %s' % WinError()
                       CloseHandle(hSnapshot)
  
  def GetProcessIdByName( pName):
         if pName.endswith('.exe'):
                pass
         else:
                pName = pName+'.exe'
  
         ProcessIds, BytesReturned = EnumProcesses()
  
         for index in range(BytesReturned / ctypes.sizeof(ctypes.wintypes.DWORD)):
                ProcessId = ProcessIds[index]
                hProcess = ctypes.windll.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, ProcessId)
                if hProcess:
                       ImageFileName = (ctypes.c_char*MAX_PATH)()
                       if ctypes.windll.psapi.GetProcessImageFileNameA(hProcess, ImageFileName, MAX_PATH)&gt;0:
                              filename = os.path.basename(ImageFileName.value)
                              if filename == pName:
                                     return ProcessId
                       CloseHandle(hProcess)
  
  def EnumProcesses():
         count = 32
         while True:
                ProcessIds = (ctypes.wintypes.DWORD*count)()
                cb = ctypes.sizeof(ProcessIds)
                BytesReturned = ctypes.wintypes.DWORD()
                if ctypes.windll.Psapi.EnumProcesses(ctypes.byref(ProcessIds), cb, ctypes.byref(BytesReturned)):
                       if BytesReturned.value&lt;cb:
                              return ProcessIds, BytesReturned.value
                              break
                       else:
                              count *= 2
                else:
                       return None
  
  
  
  if __name__ == '__main__':
         ProcId = GetProcessIdByName('RocketLeague.exe')
         #print ProcId
         print hex(GetBaseAddr(ProcId, 'RocketLeague.exe'))
         #print hex(GetBaseAddr(8252,'RocketLeague.exe'))
  </code></pre>
  
  <p>Now my understanding of memory isn't the greatest, but I'd figure that the base address should be static while a program is running. When I do get this code to run, the ModBaseAddr I get back changes every time I run it. Another weird Issue I'm having is that without that print ProcId statement, running the program returns an ERROR_ACCESS_DENIED (error 5) from line 41 (This has something to do with the CreateToolhelp32Snapshot function I assume as I have admin rights on the computer). With the print statement, however, the program runs through giving me a different ModBaseAddr every time. If I feed the GetBaseAddr function the ProcessId manually it also works without the print statement, again however, it's giving me a random address every time.
  If anyone could provide me any help or point me in the right direction I'd really appreciate it!</p>