Cheat Engine

[Tag-X]

I'm made some cheats for a game that worked well. However, they recently release a patch so I had to rebuild most of the stuff I already did (mostly just finding the right addresses of the functions).
They also introduced some anti debugging mechanics that I don't know how to defeat.
Before the patch, I was able to use the VEH debugger with hardware breakpoints pretty well, with some random crashes.
But now neither VEH nor the windows debugger work.
With windows or VEH and HW or Int3 breakpoints the breakpoints simply do not fire (or get removed by the protection ?).
With windows or VEH and page exception the game crashes once the breakpoint fires.
Attaching the debugger is never a problem.

My system is:
OS: Windows 7 64-Bit, up-to-date
CPU: Intel Core i7-3930K (6 cores, 12 threads)
RAM: 16GB

I can't get DBVM to run, neither with on-demand offloading (BSOD with 'A clock interrupt was not received on a secondary processor within the allocated time interval') nor with booting from USB-stick (doesn't even make it into the menu) .

So I set up Windows 10 32-bit on an external hard-drive and was able to debug the game in kernelmode.
The problem now is, that the game doesn't run well on Win10 (bad decision?) and crashes even without CE running.

The game takes up about 2GB of memory so when limited to 3GB on 32-bit things get very slow very fast.

I would really love to be able to debug the game on 64-bit.
I tried other debuggers (olly, ida, etc.) with several different stealth plug-ins without any success.

So the options now are to either defeat the anti-debug stuff or to get DBVM to run (and hope that it works).

I not the pro with debugging I don't even know where to start looking, for the reason the breakpoints are not firing. Also defeating the anti-debug pretty overkill for my purposes.

Now looking into the SVN there weren't any changes to the DBVM in a while.
And when I search for DBVM related stuff it seem that once DBVM runs, it works quite well.
I also read about debugging DBVM via serial port.
My MB has a serial port header, and I surely have a sub-d bracket somewhere. I also have a notebook with a serial port. Making or buying a null modem cable is also not the problem.
So helping the devs out with debugging would be no problem for me if someone told me what do do.

Any suggestions on how to proceed?

[Dark Byte]

You tried booting up with only 1 cpu enabled and hyperthreading off ?
(and have you tried dbvm on that notebook ? dbvm can be influenced by the cpu type and mainboard so it might work there)

Do you know if the serial port on your system uses port 0x3f8 ?

Anyhow, I have 2 builds here
http://cheatengine.org/temp/dbvm-release.zip : The current build in release mode with a few small fixes (deals with some new cpu incompatibilities)
it includes a bootable cd image you can try

http://cheatengine.org/temp/dbvm-debug-3f8.zip : The current build in debug mode, with serial port configured on port 0x3f8 (tell me if your system has a different port)
Also includes a bootable CD
you probably won't be able to use this much as the debug mode will halt on every CS:RIP it hasn't been told about to ignore (hardcoded) but it may show you why it fails


For using the debug port a serial connection MUST be present, else it will wait indefinitely for a command to launch the virtual machine
If you intend to debug the runtime offloading, first initialize the serial port using a terminal program (putty will suffice. Set it up to 115200 BPS and confirm the serial connection works by typing on both systems)

oh yes, if you intend on trying the runtime offload option, you'll need this to use the vmdisk.img: http://cheatengine.org/temp/dbk64-unsigned.rar (boot up with unsigned driver support)


edit:
and try http://googledrive.com/host/0BwMAnE6mjogMTmpYMGstY1NPQnc/pure%20r2902.7z

it contains a fix for the page exception breakpoints

[Tag-X]

Thank you for your reply.
I will look into it later, when I have more time on my hand.

edit:

[Tag-X]

*poke*

[Dark Byte]

5 cores with HT is more than anyone could ever need... (jk, perhaps it's a stack allocation issue where there's not enough memory for cpu 11 and/or 12 )

For putty, what part doesn't work? Setting it up so what you type show up on the other system? Or the part where dbvm loads ? If setting it up initially, make sure you provide the proper com port (and that windows didn't assign it a new port number)


for the bootloader part,:
Max address=3ffd64 is weird (sounds like a stack pointer)
Is there anything else on the display ? (there are some display only lines after max address)

if i'm correct it should have picked

[Tag-X]

[Dark Byte]

i see the problem with booting
the aligning of memory is causing the start to be in a memorylocation occupied by a device (type 2) i'll need to add a check for that (so it picks region3 instead)

what i mean with stack issue, is that dbvm only allocates 8MB RAM and divides it up by cpu count (every cpu gets it's own stack) and some private memory manager. Perhaps it's not enough

it could be that offloading takes too long, but it should do it only after each cpu has finished (cpu 0 is the one triggering the bsod, so that one is already running)

As for debugging, do not close putty. Keep it open. (if you close it windows may mess up the connection)

Anyhow,
I've updated both http://cheatengine.org/temp/dbvm-release.zip and http://cheatengine.org/temp/dbvm-debug-3f8.zip
so it now picks memory regions that have at least 8MB free (it won't fix the offloading)

[Tag-X]

[Dark Byte]

[Dark Byte]

I've changed the default stacksize of VMM threads from 256KB to 128KB and uploaded those versions here: http://cheatengine.org/temp/dbvm-release.zip and http://cheatengine.org/temp/dbvm-debug-3f8.zip

perhaps it won't cause a problem, else I may have to redo some of the memory management parts (which will be a pain. Could be it's the memory manager to begin with)

[Tag-X]

[Dark Byte]

hmm, instead of stack it could be memory allocation just failed (AvailableForPaging is too large, as there should be only 4MB max. Perhaps an underflow, but then i'd expected a MUCH higher value)


About the boot log, did you press 9 to quit the vm at the end ? (I should let it echo the command)
Next time when in that loop, press 5 for a disassembly of the code you're in to see why it's looping. Perhaps it's waiting for something that never happens, or you booted a wrong disk. Tip: If booting from usb, remove the usb disk before launching the virtual machine. Some systems don't like it when the dbvm image is on a usb disk. (old ASUS systems can even freeze the whole system, even in OS'es without usb support, like DOS)

another thing from the boot log I see is that it doesn't wake the hyperthreaded CPU's. Only the main ones get awakened

I've adjusted the memory manager so it has some more memory to use (it uses the space generated by the smaller stack now)
and I made the memory manager a bit more verbose about what it's doing

http://cheatengine.org/temp/dbvm-release.zip and http://cheatengine.org/temp/dbvm-debug-3f8.zip

[Tag-X]

[Dark Byte]

ok, this confirms the memory allocation fails (something has eaten all the available memory, even after the memory boost)

the booting, yeah, it's not an infinite loop, but a way for protected mode to call realmode code. It's possible it's doing that for every single byte it accesses (e. g windows text boot switches between realmode and protectedmode for every character it writes to the screen)
but because it causes a vmexit and subsewuent serial port slowness, it's going to be slow/takes a while

[Dark Byte]

oops, I forgot to adjust the size of the allocatable memory to the new memory size

I've uploaded new versions with fixed size, got rid of some less than useful debug message(for this case) and added a few cs:rip addresses to the ignore list based on the log

same urls