Cheat Engine

[Moon]

I found a problem in using speedhack function in CE 6.0.

In some applications, DLL's are hided. (By antihacking solution?)
When I click "Enumerate Dll's and Symbols" menu in memory viewer, nothing could be seen in the list.

Since we should know addresses of some functions and variables of injected DLL in order to activate speedhack, it doesn't work.

I found that the GetProcAddress function fails to find symbol.

I have two questions.

1. How do they hide symbols?
2. Is there any way to bypass?

[Dark Byte]

Try the 32-bit of ce so it can fall back on getprocaddress

and try kernelmode openprocess (and try rewriting ntopenprocess so it uses the kernelmode equivalent)

[Moon]

I found the problem. I was a little bit confused.

The reason why speedhack module doesn't work is because "SymFromName" function in "dbghelp.dll" doesn't work so that the it cannot locate symbols such as "realGetTickCount" and etc.

I guess it's because "SymFromName" is hooked by some anti-hacking solutions.

Is there any other way to locate symbols without "SymFromName" function?
Otherwise, how about write a new "SymFromName" function in the next version of CE?

--

[Dark Byte]

Sure, you can just check the pe data using the peinfo_ functions to find the exports in a dll

alternatively you could try to hook the ntopenprocess call that syminitialize makes use of and make it return the kernelmode processhandle by dbk32functions