Cheat Engine

[Caliber]

the following games:

Halo2
Gears of War
Kane & Lynch
Universe at War

among others are a growing list of games that utilize the Games For Windows LIVE within their code which basically does the following:

It uses a LOADER program to run the actual game. The game won't run without the LOADER and the LOADER is necessary to run the game.


The LOADER also SCANS the memory of the game at realtime for any changes to a single code. I can replace an INT3 in the games code (the main .exe) with a NOP and it will detect it (usually within a minute).

I need help in finding a way to defeat the scans. I really don't want to remove the copy protection and CD checks, just simply the scanning.

Couple things, the LOADER usually has anti-debug built into it as well, where it detects Ollydbg attached to it.

This is becoming a problem for me since most newer games that we create trainers for are beginning to use this new process.

Any help would be appreciated or if you know someone looking for a challenge that I could work with or contact at least it would help-

Thanks,
Caliber

[Labyrnth]

What happens if you pause the process of the loader?
Then try and cheat the game>?

[Caliber]

[Labyrnth]

Attach ce to the loader after the game is up and running,
Pause the process of the loader and see what happens.

Now if the game does not crash, open a new instance of ce and try to hack the game. If the game still crashes when trying to cheat, Your loader is not the problem.

Also, look for hidden files in the install. Such as dat files, You could rename it to exe and the game may run.
I cant really give you exact ways, I dont have the game but im giving ways i know that have worked on other games.

[Caliber]

[me]

[Caliber]

[Labyrnth]

How about that other file you talked about, freeze it as well.
Just another thing to try i guess.

[me]

oh look who's given a tip on getting past halo 2's anti debug tricks,,,, Dark Byte himself no less

http://forum.cheatengine.org/viewtopic.php?p=1727736#1727736

[Labyrnth]

Heh , nice find me.

I knew someone had some ideas.

[Caliber]

i did some tracing and testing and figured out what's going on and solved my problem.

just letting everyone know that apparently the games using windows LIVE loads xlive.dll and also uses the .cat file (security catalog files) and possibly the thumbprints within it to compare hash or whatever when scanning the .exe to determine if there are any changes to the game code. if you rename the .cat file then in some cases (like UAW for instance) the game won't use the scanner and your trainer will work without crashing the game. the xlive.dll has the scanner built into it to scan the game .exe. i don't know exactly how it works at this point, but it's not important since i can stop the scanning process by renaming the .cat file.

however, the problem still remains of breakpointing the game code or attaching a debugger like ollydbg without crashing the game.

by the way, i have known for some time about using the kernal debugger in CE since darkbyte told me about it many months ago. this feature has turned out to be an outstanding and powerful tool and i thank him again for his program. however, if there was some way to use kernal breakpointing so we could stop program execution with all the register, stack, etc. info at our fingertips without crashing these games with the built-in debug protections would be awesome. also since games are eventually heading to vista, then a port of this fine progam to the kernal of vista would be most helpful. i don't envy the work involved to do that by darkbyte!

any help or links or referrals to sites or individuals that can help with getting around the protections in these games and allowing breakpointing of games that crash when breakpointed would be very helpful and appreciated.

best,
Cal

[me]

nice work

as for vista doesnt the DBVM work for vista already,
not used it cos I got an amd chip, if you got intel it might help,

as for vista,
well its got 8% of the market share after what!! nearly 2 years

that 8% is mostly made up of people buying new machines that have vista pre-installed so they got no choice,
a high percentage of those seem to be either trying to duel boot with xp or in some more extreme cases just installing xp over it,

the games will rely on directX 10 and later rather than vista itself I would think, thats why bill gates tried make it vista compatable only but its already been patched to xp

[Dark Byte]

[Caliber]