Cheat Engine

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

Dear DB,

Your CE is really a master piece. Thanks for your effort to make such a nice software.

As I check the DBK Kernel, I found there is no implementation of AMD 64 support. But recently, I do encounter some computers with AMD 64 CPUs.
I just wonder if there is any planned schedule to implement AMD 64 support, or is any references I can check to help implementing this feature.

Thanks,
Barry Liou

Dark Byte · Posted: Wed Apr 12, 2006 2:43 am Post subject:

Just install windows XP sp2 (32 bit) and you're fine.
If you want to run the 64-bit windows xp it may take a while before I add that. (No inline assembler is possible in 64-bit code, and I won't even need to mention vista 64bit which'll cost me at least $700 a year if I want to do that)

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

Dear DB,

Thanks for your quick reply, I will try it.

Best Regards,
Barry Liou

tommmmmm · Posted: Tue May 02, 2006 12:23 pm Post subject:

heh, with 32bit windows....and 64 bit cpu...ya can't use more than one "memory view" hack.

I posted a topic about it some time ago.
no one helped. i'll pm you if you found a solution to that issue.

Dark Byte · Posted: Tue May 02, 2006 12:42 pm Post subject:

no it's because you are still using the old driver.
the driver that came out a week after ce 5.2 was released supports multiple.

I have a 64-bit cpu running in 32 bit xp and it works

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

To Tom, If you are using old dbk32.sys driver and you know how to compile it using ddk, in "dbkfunc.c" you could find
((DR_7.L0) && (DR_6.B0) && (DR_0=ChangeRegs[i].BreakAddress) ) ||
((DR_7.L1) && (DR_6.B1) && (DR_1=ChangeRegs[i].BreakAddress) ) ||
((DR_7.L2) && (DR_6.B2) && (DR_2=ChangeRegs[i].BreakAddress) ) ||
((DR_7.L3) && (DR_6.B3) && (DR_3=ChangeRegs[i].BreakAddress) )

Modifiy it to

((DR_7.L0) && (DR_6.B0) && (DR_0==ChangeRegs[i].BreakAddress) ) ||
((DR_7.L1) && (DR_6.B1) && (DR_1==ChangeRegs[i].BreakAddress) ) ||
((DR_7.L2) && (DR_6.B2) && (DR_2==ChangeRegs[i].BreakAddress) ) ||
((DR_7.L3) && (DR_6.B3) && (DR_3==ChangeRegs[i].BreakAddress) )

Recomile the driver, then you could fix your problem.

To DB,
There are two of my friends report to me it cant work on AMD64 machine(running 32bit XP). I still trying to get 64bit machine to test, I will report if I could find anything.

Best Regards,
Barry Liou

Dark Byte · Posted: Wed May 03, 2006 4:44 am Post subject:

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

Dear DB,

The problem is CE couldnt get the process ID of hidden process (like MapleStory) on AMD64 machine.
I think the problem is in "fix memory procedures" (like fixmem.dll), but I am not sure exactly where it goes wrong.

Best Regards,
Barry Liou

Dark Byte · Posted: Wed May 03, 2006 5:12 am Post subject:

Thats not a 64-bit issue. Same happens on 32-bit.
Use the processwatcher instead

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

Dear DB,

It worked fine on Intel CPU machine(bypassed GG of course), but how it didnt work on AMD64 machine. I had the same setting for both.

By the way, could you tell the differences between fix memory thing and processwatch unit. Thanks,

Best Regards,
Barry Liou

Dark Byte · Posted: Wed May 03, 2006 5:32 am Post subject:

the fix memory fixes the usermode part of the memory. Allowing you to open the process using the window list.

the processwatcher is code in the windows kernel that keeps track of all processes that get created or get destroyed.

In the past the fix memory was enough to make the process selectable, but since a while nprotect also has kernelmode hooks, making the processwatcher required. (or open it right before the process gets protected by nprotect, very hard to do)

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

But how to explain the fix memory still works on Intel CPU but not on AMD64 CPU.

Regards,
Barry Liou

Dark Byte · Posted: Wed May 03, 2006 6:34 am Post subject:

Perhaps a different version of nprotect, or amd has some kind of protection against kernel patching and windows enables it on those cpu's

With a intel 64 bit cpu I have no problem whatsoever.

bliou · Newbie cheater Reputation: 0 Joined: 28 Feb 2006 Posts: 17

Dear DB,

Finally I got an AMD 64 PC to test. The problem had been confirmed, the memory fix stuff doesnt work on AMD64 CPU, but it works on Intel PC.
I changed the function calls to use kernel module, and the driver did work for both AMD64 and Intel CPU.

One thing I found is the VirtualProtectEx function is not implemented in the kernel driver, it still use the one provided by kernel32.dll. So if you want to write to memory regions but protected by GameGuard, the VirtulaProtectEx call will not success without using memory fix. But it will always fail on AMD64 machine.

I just made a little change in WriteProcessMemory function of memscan.c
likes:

if ((!IsAddressSafe((ULONG)Address)) || (!IsAddressSafe((ULONG)Address+Size)))
return FALSE;

// To Unprotect the memory region
/**************************************/
MakeWritable(Address, Size, 1);
/**************************************/

DbgPrint("Copying memory to target\n");
target=Address;
source=Buffer;
for (i=0; i<Size; i++)
{
target[i]=source[i];
}

Best Regards,
Barry Liou

tommmmmm · Posted: Tue May 16, 2006 5:47 am Post subject:

i have no problems too Smile

intel pentium 4 extreme