Cheat Engine

booingthetroll · Posted: Sun Aug 31, 2014 7:03 pm Post subject: Debugger detection

Hi. I'm exploiting a game with generally poor security. It detects memory editing and all of CE's debuggers, but it looks like the debug checking is split into two: VEH and Windows/kernelmode. I disabled VEH, but I'd like to be able to use Windows/kernelmode, too. The problem is that unlike VEH, the Windows/kernelmode detection crashes the process. I traced the byte IsDebuggerPresent checks(doesn't affect it), and other of the generic detection subs. Does anyone have any insight on how to find where a process crashes at and/or other ways some processes detect attached debuggers?

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5636

The windows and the kernelmode debugger is very different. If you are using 32-bit or DBVM, use kernelmode debugger with global debug routines. On 64-bit, kernelmode debugger (without DBVM) is causing a BSOD.