Cheat Engine

[lylcheat]

Just a theoretical question. Other people mentioned about making a UCE by changing the source code and recompiling CE. But is that safe enough? Assuming I need to use the CE kernel driver which must be signed in 64bit win, would that signature somehow be used to identify the existence of the CE driver in memory, and hence allows one to pinpoint any running user mode process that is sending request to the driver e.g. by hooking each user mode process's DeviceIoControl to see if anyone sends request to the CE driver.

[Dark Byte]

yes, it can be used to detect ce. (and probably is)
If you don't want that, then build the driver yourself and sign it with your own business certificate. (or boot up and tell windows not to care about signed drivers)
If you're editing CE's driver to make it undetected, you have to do that anyhow, I don't provide people with the "Cheat Engine" code signing certificate...

Hooking deviceIoControl in kernelmode is a bit difficult in 64-bit due to patchguard, but it's possible in usermode. And yes, it's possible. e.g nprotect did that a long time ago to detect the game's PID (that was 32-bit then)
One easy way to get past that is just encrypt the data in the deviceiocontrol message, and then decrypt it in the iocontol dispatcher in the driver before handling it

[lylcheat]

[Dark Byte]

no idea, I havn't seen any. Also, 32-bit windows doesn't care if it's signed or not.