Q:

Assembly Pointer and base address

As i am a assembly language beginner and studying purpose, I am trying scan memory address and pointer in a game. I am kind of confusing about pointer and address. 
I found the pointer by a tutorial on youtube, but i want some depth understanding of this pointers and offset.

I don't understand how those offset and address add up together and give a final address that stored a value of 1000.
What I understand is that 00F8EBE0 is base address, " 22,20,10,C,20" are five offset. 
00F8EBE0 -> 11DA0924 = 1000  How this happen?
How could I read 00F8EBE0 value with C++? Do I need those offset to help me to get the final value?

A:

In the process's virtual memory space, the image file ("something.exe") is loaded. If you add 0x00F8EBE0 to that address and read that location, you'll get 0x127B5450. Read the arrows as "points to" and the values in square brackets as "address plus offset". You can programatically get the image base using the ToolHelp32 API.
What you have here is a chain of pointers to object structs, with each offset giving you where the next pointer is in the struct/object.
To use this information from another program you can use ReadProcessMemory. Starting from the first offset (the image base), call ReadProcessMemory and then add the relevant offset to it, then repeat. The general process is as follows:
//assuming you've calculated the image base of the target
//and acquired a handle to the process:

LPVOID base = ImageBase + 0x00F8EBE0; //note: EntryPoint needs obtaining properly
LPVOID value;
ReadProcessMemory(hnd,base,(LPVOID) &value,sizeof value, NULL);
base = value + 0x20;
ReadProcessMemory(hnd,base,(LPVOID) &value,sizeof value, NULL);
base = value + 0xc;
ReadProcessMemory(hnd,base,(LPVOID) &value,sizeof value, NULL);
base = value + 0x10;
ReadProcessMemory(hnd,base,(LPVOID) &value,sizeof value, NULL);
base = value + 0x20;
ReadProcessMemory(hnd,base,(LPVOID) &value,sizeof value, NULL);
base = value + 0x44;
ReadProcessMemory(hnd,base,buf,sizeof value, NULL);
//value will now contain the number 1000.

Note that there aren't any guarantees the process' address space will look the same each time it runs; if it allocates any memory the first offset to the entry point (0x00F8EBE0) won't be the same.

