Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Error 31 running dbk64.sys

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
morteeeeh
How do I cheat?
Reputation: 0

Joined: 12 Jan 2022
Posts: 1

PostPosted: Fri Jan 14, 2022 5:42 am    Post subject: Error 31 running dbk64.sys Reply with quote

Hi, I am currently studying Yosifovich's Windows Kernel Programming. Yes, I want to better understand kernel programming and other intricacies.

Long story short, after searching various things I have met Cheat Engine. Downloaded it and tried to run its driver, just like I would run any other driver.

So I go with

Code:

sc create dbk64 type= kernel binPath=dbk64.sys-full-path
sc start dbk64


Should work right? No!

Code:

StartService FAILED 31:

a device attached to the system is not functioning.


Uh why? I tried running other drivers with this method and it works. Trying to find a solution on Google, I get to the paper

"GhostEmperor: From ProxyLogon to kernel mode"

Holy, hacker stuff!! They will eat me alive Laughing

But I see that

"It is worth mentioning that the malware’s service makes use of a Cheat Engine utility called kernelmoduleuloader.exe (MD5: 96F5312281777E9CC912D5B2D09E6132) during the loading of the dbk64.sys driver. The driver is dropped along with the utility and a .sig file, with the latter being used as a means of authenticating the component calling dbk64.sys by conveying a digital signature that is associated with its binary."

Yeah ok, it seems there is a logical reason behind the error 31. They talk about using an exe from Cheat Engine as a mean to authenticate the accesses to the driver.

But I am a newbie into driver development and it sounds strange to me that there is a sort of authentication involved in user mode code calling a driver.

So, I am at a loss. I have the error 31, but I don't know where it comes from. Is there something in the dbk64 source code that implements such an authentication mechanism??

I have run many drivers using sc and I have never encountered such a thing. So I don't know.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites