Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Defeating anti debug, also DBVM issues
Goto page Previous  1, 2
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Tag-X
Newbie cheater
Reputation: 0

Joined: 19 Jan 2015
Posts: 12

PostPosted: Tue Feb 24, 2015 8:48 am    Post subject: Reply with quote

Ok, more progress as it seems!

Boot with 6 cores and HT disabled:
https:/ /paste.ee/p/1Axgc

Debug build seems now to get as far as the release build.
After the last output, it halted with no reaction on key press or hard drive access (at line 1317 it tries to execute DB 0x66, wtf?!)

Offloading with 6 cores and HT enable:
https:/ /paste.ee/p/210L1

Seems to work now (yay!):
http:/ /pl.vc/5nj0z

However, I tried it again after reboot (which also worked: https:/ /paste.ee/p/xiHuh ) and then put my PC into energy saving mode (I read that it disables the VM and it seem to have worked). After that I tried the offloading again and got this:
https:/ /paste.ee/p/LgULL
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 458

Joined: 09 May 2003
Posts: 25296
Location: The netherlands

PostPosted: Tue Feb 24, 2015 10:35 am    Post subject: Reply with quote

db 0x66 means to run the next command in the reverse addressing mode than it's currently in (32-bit code executes as 16-bit, 16-bit code executes as 32-bit)
the disassembler library used does it a bit weird with some instructions (like lgdt)
this is a valid part of initializing an CPU

As for the crash, it looks like it's happening after windows has awakened the other cpu's (I have a feeling that if you boot with just 1 cpu without hyperthreading it'll work)

Note that during the initialization of the secondary cpu's you have to be quick. (e.g linux only gives you 1 seconds before deciding a cpu has failed)

The issue here is that it's going into a unhandled doublefault, which would normally cause a reboot.
perhaps some of the realmode emulation goes wrong, it took too long and windows zeroed out the entrypoint for the cpu.

as for the reason, I can't say right now
apparently at 2699 an pagefault occurs, trying to dispatch interrupt 8 but the IDT hasn't been setup.
which was caused by 10:fffff8000311b2e6->0:2699

There's a reason I prefer runtime offloading (but perhaps when I get time I'll check if my latest system has hardware realmode VM support so I don't have to emulate that and implement that. (i7 920 does not) )


After energy saving mode, did you close and unload the driver first ? (kernelmoduleunloader)
else the driver might have remembered it's still loaded, and might instead load the first cpu assuming it's already initialized, which can explain the pagefault interrupts

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Tag-X
Newbie cheater
Reputation: 0

Joined: 19 Jan 2015
Posts: 12

PostPosted: Tue Feb 24, 2015 2:52 pm    Post subject: Reply with quote

Dark Byte wrote:
As for the crash, it looks like it's happening after windows has awakened the other cpu's (I have a feeling that if you boot with just 1 cpu without hyperthreading it'll work)


I tried 1 core with HT disabled:

https:/ /paste.ee/p/8m9m1

Ignore the first few menus, those where form the 'Windows did not proplerly boot'-menu.


Dark Byte wrote:
After energy saving mode, did you close and unload the driver first ? (kernelmoduleunloader)
else the driver might have remembered it's still loaded, and might instead load the first cpu assuming it's already initialized, which can explain the pagefault interrupts


The kernel module unloader did the trick. Worked fine once I used it after the energy saving mode.

Dark Byte wrote:

There's a reason I prefer runtime offloading (but perhaps when I get time I'll check if my latest system has hardware realmode VM support so I don't have to emulate that and implement that. (i7 920 does not) )

I agree that runtime offloading should be the preferred approach.
Have you considered make a unloading feature for the VM once the debugging is finished? The energy saving + unloading of the kernel module is quite inconvenient.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Goto page Previous  1, 2
Page 2 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites