Cheat Engine

kitesan · Posted: Sun Feb 08, 2015 3:18 pm Post subject: Help and Infos

Hello boys.. i hate to be repetitive but i need infos and help about integrity check inside FC4 and ACU.. i would like to know how to do what stealthedit does so i can do it manually...

hhhuut · Posted: Sun Feb 08, 2015 7:36 pm Post subject:

Well, there's a great tutorial about the stealthedit plugin here: *Sorry, can't post URLs yet, but just search for "cheat engine stealthedit" via Google and click on the second link*

In short version:
It marks a specific Memory page as "Not executable" which will raise a DEP-Error when the program tries to enter (and execute) this Code page.
CE will kind of interfere this error and redirects the program to the page's copy, where you can inject code despite integrity checks.
Note: The stealthedited code page is still readable, so the memory check routines will scan the original code (and find no injections) while the code is actually executed from a different memory region.

kitesan · Posted: Mon Feb 09, 2015 10:19 am Post subject:

Thanks alot, and how to mark a specific Memory page as "Not executable" manually? i must change something inside the header? how to redirects the program to the page's copy? Thanks in advance

++METHOS · Posted: Mon Feb 09, 2015 10:31 am Post subject:

Here is a template for Stealthedit with AOB:

kitesan · Posted: Mon Feb 09, 2015 10:35 am Post subject:

thanks alot METHOS But I wanted to learn how to do stealthedit's job manually..
NEW: my goal was to learn lol

++METHOS · Posted: Mon Feb 09, 2015 10:56 am Post subject:

Ask Geri about Stealthedit.

Writing a dll that performs similarly to stealthedit has been discussed, but the discussions have always been brief and limited because the topic just requires all involved to already have some understanding of things that are generally more advanced and those things just take time to learn.

There are a handful of members here that can help with it if they have time and are willing. Very Happy

But...most of it just has to be learned...there is no magic answer that will give you understanding, I'm afraid.

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5636

If it would be just "change a few bytes here, click a few times there", someone would post it in 5 sentences how to do it, but it's not working that way.

CE has many features, amongst these are the options to show memory regions (CTRL+R) and also to change access and copy memory with AA instructions and it has a few different debuggers too. If you are really curious how are these things done, get the source code and dig through it.

To do something similar to stealthedit "manually", you could use the debugger. Set up a breakpoint and change EIP register to point to a different location. That can be done with CE debuggers.

This plugin is much more complicated than you think. After all, it contains features which are above the basic CE and even the basic CE packs so many advanced features, that beginners don't even have a clue about the extent of this software.

kitesan · Posted: Mon Feb 09, 2015 12:21 pm Post subject:

Thanks alot boys but at least tell me from where to start to get an overall understanding of it... or at least give me some advice about killing multiple checks at once

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5636

There is no easy solution, this is why the plugin was created.

I told you a solution which is easier to do with the debugger and I have also made an article years ago about bypassing a single memory check. Of course you can also try to use pointers.

danrevella · Posted: Mon Jun 01, 2015 7:05 am Post subject: