Cheat Engine

booingthetroll · Posted: Tue Feb 24, 2015 3:50 pm Post subject: Options for debugging file access

Hey there! This is probably an easy question, but if I could get an answer, it'd help a ton with what I'm trying to do. A program I'm messing with has a lot of security, and included is a feature to send a hash of the file to the server to be verified. The hash is NOT built in, and my naive self needs to know the best options to see where and how it's reading its static bytes. I'm guessing it'd be possible to monitor file accesses in a virtual machine, but for a start, could I have some common functions that'd be used specifically for this? It's a large program, so the more specific the better, but there's about a 98% chance it's a simple win32 function. Packets are queued so debugging the sending itself would be unfavorable.

SteveAndrew · Posted: Tue Feb 24, 2015 5:04 pm Post subject:

Hash of the file? You mean hash of the executable running? Did you try doing a find what accesses on any address of the executable? Just add any address to your CT and then do a find what accesses. If there's anything hashing it, it should come up! Use VEH debugger if the windows debugger fails.

Then either spoof the hash/CRC or just make a copy of the entire area of memory where you modify and redirect it to your copy.

booingthetroll · Posted: Tue Feb 24, 2015 5:42 pm Post subject:

They have that, too, and it's pretty easy to get around, but I'm looking into hex editing the actual file permanently - the problem is that the actual file is hashed.