Cheat Engine :: View topic - CheatEngine Modifying System Files at launch?

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

CheatEngine Modifying System Files at launch?

Cheat Engine Forum Index -> General Discussions

View previous topic :: View next topic

Author

Message

thefifthlord
How do I cheat?

Reputation: 0

Joined: 18 Sep 2006
Posts: 4

Posted: Tue Aug 04, 2015 11:36 am Post subject: CheatEngine Modifying System Files at launch?

Why does cheat-engine do this?

Code:

8/4/2015 1:15:25 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\ntdll.dll)
8/4/2015 1:15:25 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\kernel32.dll)
8/4/2015 1:15:26 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\KernelBase.dll)
8/4/2015 1:15:27 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\apphelp.dll)
8/4/2015 1:15:27 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\oleaut32.dll)
8/4/2015 1:15:30 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\msvcrt.dll)
8/4/2015 1:15:31 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\combase.dll)
8/4/2015 1:15:31 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\rpcrt4.dll)
8/4/2015 1:15:32 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\user32.dll)
8/4/2015 1:15:34 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\gdi32.dll)
8/4/2015 1:15:35 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\ole32.dll)
8/4/2015 1:15:36 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\sechost.dll)
8/4/2015 1:15:37 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\advapi32.dll)
8/4/2015 1:15:37 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\shell32.dll)
8/4/2015 1:15:37 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\windows.storage.dll)
8/4/2015 1:15:38 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\version.dll)
8/4/2015 1:15:38 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\shlwapi.dll)
8/4/2015 1:15:38 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\kernel.appcore.dll)
8/4/2015 1:15:38 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\SHCore.dll)
8/4/2015 1:15:39 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\powrprof.dll)
8/4/2015 1:15:39 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\profapi.dll)
8/4/2015 1:15:39 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\comdlg32.dll)
8/4/2015 1:15:39 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\ws2_32.dll)
8/4/2015 1:15:40 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\nsi.dll)
8/4/2015 1:15:40 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\imagehlp.dll)
8/4/2015 1:15:40 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\imm32.dll)
8/4/2015 1:15:40 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\msctf.dll)
8/4/2015 1:15:40 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\opengl32.dll)
8/4/2015 1:15:41 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\wsock32.dll)
8/4/2015 1:15:41 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\hhctrl.ocx)
8/4/2015 1:15:41 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\ddraw.dll)
8/4/2015 1:15:41 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\glu32.dll)
8/4/2015 1:15:41 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\dciman32.dll)
8/4/2015 1:15:42 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\SpyshelterProtHlp.dll)
8/4/2015 1:15:42 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\uxtheme.dll)
8/4/2015 1:15:42 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\msimg32.dll)
8/4/2015 1:15:42 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\bcryptprimitives.dll)
8/4/2015 1:15:42 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\clbcatq.dll)
8/4/2015 1:15:43 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\ExplorerFrame.dll)
8/4/2015 1:15:43 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\shfolder.dll)
8/4/2015 1:15:43 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\psapi.dll)
8/4/2015 1:15:43 PM,C:\Program Files (x86)\Cheat Engine 6.4\cheatengine-x86_64.exe,41,Modifying protected file (C:\Windows\System32\propsys.dll)

STN
I post too much

Reputation: 43

Joined: 09 Nov 2005
Posts: 2676

Posted: Tue Aug 04, 2015 11:49 am Post subject:

Your program is lying or you have no idea what you are doing/seeing _________________ Cheat Requests/Tables- Fearless Cheat Engine https://fearlessrevolution.com

atom0s
Moderator

Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1

Posted: Tue Aug 04, 2015 11:49 am Post subject:

These are all the imports that Cheat Engine makes use of on the system. Whatever program you are using that says it is modifying them is probably wrong in stating that Cheat Engine is opening them for usage / reference. _________________ - Retired.

thefifthlord
How do I cheat?

Reputation: 0

Joined: 18 Sep 2006
Posts: 4

Posted: Tue Aug 04, 2015 1:22 pm Post subject:

atom0s wrote:

These are all the imports that Cheat Engine makes use of on the system. Whatever program you are using that says it is modifying them is probably wrong in stating that Cheat Engine is opening them for usage / reference.

Hi,

The program I am using is called SpyShelter.

What is strange is that for virtually every other application. Imports like these are stated as read access.

I don't think its actually modifying them, because I ran some checks on the date stamps for the DLLs and they seem to have not been modified since the windows installation.

Furthermore, an SFC call on the DLLs seems to find no integrity violation, and the digital signature is intact.

Could it be that CE is opening them in read/write mode instead of read mode?

Dark Byte
Site Admin

Reputation: 471

Joined: 09 May 2003
Posts: 25830
Location: The netherlands

Posted: Tue Aug 04, 2015 1:47 pm Post subject:

As far as I can see they are opened using LoadLibrary or statically loaded using the PE header. Can you verify that the digital signature of the cheatengine-x86_64.exe is still intact ? (In case it got infected by an exe infecting virus, and since those files are protected it can't change them) _________________ Do not ask me about online cheats. I don't know any and wont help finding them. Like my help? Join me on Patreon so i can keep helping

Display posts from previous:

	Cheat Engine Forum Index -> General Discussions	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum