Cheat Engine

mahe4 · Newbie cheater Reputation: 0 Joined: 06 Mar 2015 Posts: 23

hi,
i was discussing with a friend, how every program that reads ram outside it's own program needs admin rights to do so.
then he showed me cheat engine 6.1 portable...
and it works without ever asking me for admin rights...
i can scan and change any value i want.
can someone tell me how this is working?
is there some kind of windows security hole or something?
i want to know how i can prevent this from happening on my pc.

STN · Posted: Sat May 16, 2015 7:19 pm Post subject:

You need admin privileges for debugging but not for simply memory modification i guess.

I have seen some trainers work despite not being run in admin mode so OpenProcess probably works without admin. Some access permissions probably.

You want to prevent what ? Stop CE from being run without admin ? I don't think that is possible, you would have to change windows architecture/kernel or mess with CE through a separate program to stop its functionality. Why would you even want to do that, i have no idea

mahe4 · Newbie cheater Reputation: 0 Joined: 06 Mar 2015 Posts: 23

Dark Byte · Posted: Sat May 16, 2015 8:23 pm Post subject:

processes running under the same user account can access eachother (if they have the same privilege level)
try running processes you want safe from another user account (run as... feature of windows)

perhaps you can change the local security policy and change the policies regarding memory access to admin only

mahe4 · Newbie cheater Reputation: 0 Joined: 06 Mar 2015 Posts: 23

Dark Byte · Posted: Sat May 16, 2015 10:46 pm Post subject:

nope, perhaps it's something hidden well, requires you to add a whole new policy tree, or it's just not available (You could write a kernelmode driver that register an ObCallback and deny it there, but that'd be a bit extreme)

An alternate solution is just run everything you don't trust inside a virtual machine

mahe4 · Newbie cheater Reputation: 0 Joined: 06 Mar 2015 Posts: 23

Rydian · Posted: Tue May 19, 2015 9:01 pm Post subject:

IIRC Sandboxie (and perhaps other sandbox software) can be used for this if you don't want the performance hit of a VM, if all you need is separation.