Cheat Engine

Moon · How do I cheat? Reputation: 0 Joined: 15 Feb 2011 Posts: 9

In order to find the minimal set of operations that doesn't detected by HS, I made a new project in lazarus and imported very small set of functions from CE 6.0.

The functions I imported to my project are:

GetDriverVersion (its function name is modified.)
OP (its function name is modified.)
InitializeDriver
DBK32Initialize (function name, servicename, processeventname, threadeventname are modified.)

and some related functions in vmxfunctions.

and I also modified IOCTL interface in both device driver and project

However, it is still detected. When deviceiocontrol function in GetDriverVersion in DBK32Initialize called, the program is detected and HS kills the application.
I guess HS may hook the deviceiocontrol function and detect some operations in device driver. Is that possible? I'm not sure what can I do more. Do you have any idea?

--

Dark Byte · Posted: Mon Feb 28, 2011 7:26 am Post subject:

or it's randomly looking if the device driver is loaded

If you don't call get driver version, and just halt indefinitely, is it then still detected ?

Anyhow, if it's the deviceiocontrol call change the ioctl values e.g: $0816 + $1ce (also change them in the driver)
And perhaps it's looking for the return value of the driver version, so you might want to change that as well