Cheat Engine

[InternalError]

I try to attach debugger to the program with some anti-debug protection(KM protection). I unprotected the process handler, but anyway get the errors. If i run this program with out protector, debugger (im use DBVM level) works ok. I want to understand what is the problem. Error messages are TOO vague...
When I press attach to protected process i get "Access Violation". BUT! CE stops working correctly. After this, CE says DBK Error: "Access Violation" to any process... Ok, i restart CE.. At startup he says "The driver couldnt be opened! Its not loaded or not responding. I recommended to reboot your system and try again". Protection breaks CE??

[Dark Byte]

likely it blocks dbk and process opening

but what you could do is load dbvm, disable all ketnel options close ce, unload the driver and start ce again

with dbvm loaded you can still access a process using it's cr3 value. dbvm has a cr3 logger . so log some, then query all results for some information to figure out which one is correct

then with that you can do memory reads and find what access/writes using dbvm

(i could probably make a cr3 processpicker in ce/ce lua which then works as a normal opened process)

[InternalError]

Ok, after some cycles of stop/start cedriver73 I was able to connect the debugger xD. Hope I can do it again.. I would also like to know more about cr3.. how to apply it with CE? Because I have to patch some stuff in kernel memory to unlock the process handle. This is a bad way. I don't know much about how debuggers work. And yet, is there an opportunity in the dbvm-level debugger to debug kernel functions step by step? I do not quite understand how I could put a hardware breakpoint in kernel space

[InternalError]

So, I noticed that debugging don't correct works in kernel mode. Me need to trace some simple IRP routines. Breakpoint hits and "step by step" are works, but debugger shows strange information

[InternalError]

If anyone encounters a similar problem, then this is due to the fact that the debugger is attached to the wow64 process. Change the context to any x64 application and everything will work.
Problem solved.