 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
UnLmtD Grandmaster Cheater
Reputation: 0
Joined: 13 Mar 2007 Posts: 894 Location: Canada
|
Posted: Mon Jun 02, 2008 6:17 pm Post subject: CE 5.4 interference |
|
|
Hi, although I'm not sure this is the right section to post in, I'll post here =)
Today, I was messing with a ObReferenceObjectByHandle inline hook. Everything was working perfectly and as I planned, but unfortunately when I decided to open CE 5.4 while my driver was loaded, it blue screened me =\
Have anyone experienced this before?
I've attached the source code, maybe after all my driver is flawed =(
Thanks a lot.
(P.S I know the code is ugly, it's always like that until I'm done...)
_________________
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25788 Location: The netherlands
|
Posted: Mon Jun 02, 2008 6:28 pm Post subject: |
|
|
Well, one thing I have to say: EEW, unicode sourcefile.
besides that:
The only times CE calls ObReferenceObjectByHandle is at:
Code: | ObReferenceObjectByHandle((HANDLE)pinp->ProcessEvent, EVENT_ALL_ACCESS, NULL,KernelMode, &ProcessEvent, NULL);
ObReferenceObjectByHandle((HANDLE)pinp->ThreadEvent, EVENT_ALL_ACCESS, NULL,KernelMode, &ThreadEvent, NULL);
|
Can't really find much wrong. Perhaps something somewhere wants the HandleInformation
Also check what happens when *PsProcessType!=ObjectType , I've quickly skimmed it, but is it calling the routine with the correct params ?
Add in some checks for NULL pointers, etc...
but besides that, can't see much wrong. I would rather let CE build the assembler hooks up internally in kernel AA, but I guess that's not a solution for your project.
also, regarding GG, last time I checked they did hook or protect this function (bit they didn't hook/protect the functions it calles)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping
Last edited by Dark Byte on Mon Jun 02, 2008 6:41 pm; edited 1 time in total |
|
Back to top |
|
 |
UnLmtD Grandmaster Cheater
Reputation: 0
Joined: 13 Mar 2007 Posts: 894 Location: Canada
|
Posted: Mon Jun 02, 2008 6:36 pm Post subject: |
|
|
Alright thanks for the reply, I'll try to fix the problem, and I'm using the original CE 5.4
_________________
|
|
Back to top |
|
 |
nwongfeiying Grandmaster Cheater
Reputation: 2
Joined: 25 Jun 2007 Posts: 695
|
Posted: Mon Jun 02, 2008 11:32 pm Post subject: |
|
|
I like this version, but the terminate function is buggy. It seems to finish scanning, then reset.
Just a small comment, but I think DarkByte should implement a really cool skin to it.
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|