Cheat Engine

predprey

As long as the game itself handles the page fault exception and resets back the page execution flag, execution flow seems to completely bypass stealthedit’s exception handler?

OldCheatEngineUser · Jul 26, 2020

stealthedit is old, so i would expect this.

predprey · Posted: Wed Dec 12, 2018 7:00 am Post subject:

I guess one can hook the exception handler and disable the reset and any nearby checks or hook the virtualprotect routine but it ends up being a purely cat and mouse game with the devs?

Dark Byte · Posted: Wed Dec 12, 2018 8:10 am Post subject:

Or use it to find the integrity check codes instead and patch those

(or get an intel cpu)

OldCheatEngineUser · Jul 26, 2020

intel cpu?

Dark Byte · Posted: Wed Dec 12, 2018 8:22 am Post subject:

OldCheatEngineUser · Jul 26, 2020

interesting, where can i find some more info about it?

Dark Byte · Posted: Wed Dec 12, 2018 8:37 am Post subject:

Intel VMX EPT. It can mark a physical memory(RAM) page as executable, but not read or write. So the cpu will just fetch instructions and execute it without any slowdown, but read and writes will trigger a cpu event you have to capture (e.g swap out memory with original, single step, swap back, continue)
And swapping is as easy and fast as updating a single pointer

OldCheatEngineUser · Jul 26, 2020

ah damn, sounds like a pretty much complicated topic. (because its related to virtualization which i dont have much knowledge about)

thanks db.

Dark Byte · Posted: Wed Dec 12, 2018 9:01 am Post subject:

predprey · Posted: Wed Dec 12, 2018 9:02 am Post subject:

Dark Byte · Posted: Wed Dec 12, 2018 9:13 am Post subject:

Hmm, that should have been fine. DBVM does not need the driver to keep live(You can even load DBVM at boottime using floppy, CD, or USB, even uefi is supported).

But you will need to find a way to get physical addresses though (dbvm_log_cr3_start and parse the pagetables manually)

predprey · Posted: Wed Dec 12, 2018 9:45 am Post subject:

Dark Byte · Posted: Wed Dec 12, 2018 10:10 am Post subject:

well, restarting your comp with dbvm loaded is always bit iffy as you're turning of the virtual machine inside DBVM OS and that's not really supported
(Tip: You can unload DBVM by putting your computer to sleep/standby

Tip2: Don't let your computer go into sleep/standby when using DBVM related things using the driver lol)

and yeah, getPhysicalAddressCR3 is what you'll need, I forgot about that helper (once you've figured out the CR3 you need. Though I guess you can read the physical memory and confirm it matches the virtual memory)

OldCheatEngineUser · Jul 26, 2020