Cheat Engine

h3x1c

I know why DBVM is useful and what enabling it allows you to do, but what I'm wondering is what's actually happening when you load DBVM? Like, under the hood, what is DBVM doing in relation to everything else in memory (OS, other applications, etc.)?

I would go digging through the source code to try and make heads or tails of things, but outside of Assembly, I'm still quite the noob with programming at the moment. Embarassed

I'm just curious and would like to really understand how DBVM does what it does. Thanks!

Dark Byte · Posted: Thu Aug 25, 2016 9:39 am Post subject:

dbvm launches a hardware based virtual machine, and either boots up windows (or linux, or macos) or changes the current system session into that virtual machine.

After that DBVM will run the OS and is able to emulate hardware like physical memory, see low level operations like control register access, intercept interrupts, etc...

h3x1c · Posted: Thu Aug 25, 2016 10:00 am Post subject:

Dark Byte · Posted: Thu Aug 25, 2016 11:43 am Post subject:

Exploit-ish, nope. But hackish, I guess you can call it that.

After saving the current CPU state , it changes it to what DBVM is designed for. (Custom paging setup just for DBVM and it's memory management)
If compiled as debug build, it will try and connect to a serial port on a hardcoded IO port and output debug information to it, and also take commands from it)

Then it sets up a virtual machine with the saved CPU state, and runs it, followed by an infinite loop where it handles virtual machine events

h3x1c · Posted: Thu Aug 25, 2016 5:03 pm Post subject:

Really neat stuff, man. Thanks for the insight. Gives me a lot to specifically look into. =)

predprey · Posted: Thu Aug 25, 2016 5:23 pm Post subject:

i am curious as to how many times did your system crash while developing and testing DBVM Laughing

Dark Byte · Posted: Thu Aug 25, 2016 6:40 pm Post subject:

Often, but I also tested on an emulator like Bochs which helped a lot. (of course it had a few bugs so I did still have to test on real hardware as well)

I of course used a test system specifically for this so at most I just had to build, press reset and book up using a usb stick with the DBVM img on it. (DBVM is designed to be able to load the operating system from boot time. The runtime offloading is just something I added later)