 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
sullx
Cheater
![]() Reputation: 0
Joined: 03 Jan 2013
Posts: 37
|
 Posted: Tue Jan 08, 2013 8:24 pm Post subject: Disconnect after injecting |
 |
|
First off, I am finding much on this forum educational, so thank you contributors.
Currently I have an injection that seems to accomplish exactly what I hoped it would, except that shortly after injecting the game closes. This game happens to be an online game with an anti cheat (I won't name which because that is probably against policy), but I am wondering.. Which of these scenarios is more likely:
The anticheat detected a change to the game and so it closed the game.
The anticheat detected use of certain windows api functions used to inject, and so it closed.
Thanks so much for your input. If this thread is against policy, please feel free to close it.
--- edit ---
Ok I am thinking it's probably a CRC. I found this posted by DarkByte a while back
| Quote: | Anyhow, first way is find out what code reads from the target process's memory and then modify that code so it always returns the same value.
Easiest method is just making a copy of the game's memory and adjust the read pointer to the copy
another method is making the target page you want to edit non executable and copy it to another region and edit it so that relative jumps and relative memory accesses are corrected (easiest is just copy the whole module)
Then hook the pagefault handler and on execute pagefault change eip to the copy
You can do all your editing in the copy without any problems
(Look up stealthedit plugin for an example implementation of this in ce. tip: if you run dbvm the pagefault hook will be undetectable)
Easiest method is just making a copy of the game's memory and adjust the read pointer to the copy
another method is making the target page you want to edit non executable and copy it to another region and edit it so that relative jumps and relative memory accesses are corrected (easiest is just copy the whole module)
Then hook the pagefault handler and on execute pagefault change eip to the copy
You can do all your editing in the copy without any problems
(Look up stealthedit plugin for an example implementation of this in ce. tip: if you run dbvm the pagefault hook will be undetectable) |
When he says "first way is find out what code reads from the target process's memory" does he mean to find the memory address that stores the size of the games memory and then to fix that value so even if it changes its always read the same? If so, how does one go about finding that place in memory?
The second method seems a lot more complex, still trying to understand it.
--- edit 2 ---
Just found what seems to be an awesome source that may be an answer to my original question. It's located here hxxp://forum.cheatengine.org/viewtopic.php?t=556722&sid=a24b2a8ea1979a476c059ccce50c3041 (change the x's to t's in the link)
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25801
Location: The netherlands
|
| Posted: Wed Jan 09, 2013 5:36 am Post subject: |
|
|
that link is to a tutorial that assumes functions are checked individually, but most of the time, it's just one go from start to finish of the .code section of the module being checked
With "Find what code reads from the target memory" is place a read breakpoint at the address of some code you wish to edit and wait.
With luck you will get one address that reads it.
go to the function and find out how it works, and then the easiest method is to change the read pointer of the integrity check to a copy of the memory that is unchanged
The page marking as non executable is what stealthedit does
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
