Cheat Engine

Dark Byte · Posted: Mon Jan 07, 2008 8:06 pm Post subject:

hehe, yes, just made it myself. Everything in there is made by myself to be sure there's no secondary os that can interfere with stuff.
From bootloader to secondary bootloader to 64-bit os (accessible with serial port)

and I see the cause of the pagefault, but not sure why. i'll have to delve into the code a bit more.
the instruction is "or byte ptr ss:[r12+rax],0x01" and r12+rax does go to 00800000 (right after the start of the stack)
Now I got to find out WHY

Dark Byte · Posted: Mon Jan 07, 2008 10:33 pm Post subject:

it may have to do with the memory regions.

try this one, perhaps it manages to display the data before crashing:
http://www.cheatengine.org/dbvm04g.rar

killer+bee · Posted: Mon Jan 07, 2008 11:00 pm Post subject:

New behavior. Seems to have made it much farther this time. That general protection fault you were looking for fired. Some stuff scrolled up the screen. Tried to up arrow. When I did out popped the last line about CPU CORE 1(1). Then freeze. Couldn't scroll up to see what went by.

Dark Byte · Posted: Tue Jan 08, 2008 12:34 am Post subject:

this is really annoying. It's just a fluke that this time your system worked more with this compile, since I didn't change anything. moved a debugline.
And then the gpf is too random

Dark Byte · Posted: Tue Jan 08, 2008 12:58 am Post subject:

i've uploaded a new one:
http://www.cheatengine.org/dbvm04h.rar
now the vmloader module also contains display output instead of serial port output. It should give some better indication about the original state of the memory regions and which one it picks and why.

killer+bee · Posted: Tue Jan 08, 2008 1:07 am Post subject:

If nothing else, this has inspired me to make bootloaders with nasm. I've made a really simple one that takes keyboard input and displays insults. I dd it to floppy when I'm not testing new dbvm builds. Smile

For iso it looks like you are using mkisofs?

I'll edit or post back with results of latest dbvm.

Dark Byte · Posted: Tue Jan 08, 2008 1:16 am Post subject:

yes, for the iso I use mkisofs and just give it the img file

and yes, playing with bootloaders is fun.
dbvm works like this:
512byte bootloader in asm which loads vmloader.bin
vmloader.bin sets up 32-bit protected mode in yasm, and then jumps to a section I wrote in gcc (crosscompiler version of gcc, since my laptop doesn't support 64-bit)
from there it picks a usable memory region, and loads the vmm.bin file.
when done it switches to 64-bit mode and jumps to the entry of vmm.bin

vmm.bin is mostly done in c, with one small .asm file for low level stuff (getting control registers and the intel VT instruction set and the vmxloop)

killer+bee · Posted: Tue Jan 08, 2008 1:31 am Post subject:

I ran it several times. The behavior is a bit erradic. About 50% of the time when I 'press any key' after the vmloader finished message, the system will not continue and instead reboots. The other 50% of the time after I press any key after the vmloader finished message, the system will continue to display the last pic in the rar file attached.. then freeze as before.

I took several pics of the operation boot after boot and the values don't change so it's hard to understand why the behavior does. Sometimes it reboots and sometimes it continues then crashes. *shrug*

I think when it reboots, the messages in the 3rd pic are displayed but they disappear via reboot so fast I don't see them. I see a very brief flash of something that might be text then reboot.

On further consideration I believe that the general protection fault randomly freezes or reboots the system. That would explain why sometimes it reboots and sometimes not. I'm probably over thinking this. Hope the pictures are insightful.

3 pics in rar.

Dark Byte · Posted: Tue Jan 08, 2008 11:57 am Post subject:

I can see what's going wrong now.
it picks a memory region in the region above 4GB and some overflow bugs. (and since the vmloader is 32-bit this is kinda a problem)

could you make a screenshot when you only have 2GB ?

Ona side note: on 32-bit your system only has 3.2GB available

killer+bee · Posted: Tue Jan 08, 2008 12:52 pm Post subject:

Dark Byte · Posted: Tue Jan 08, 2008 1:07 pm Post subject:

actually a 32-bit cpu can make use of that extra memory using special paging techniques. Such a shame microsoft only allows it on windows 2003 server.

and this time I see nothing weird...
the vmm is loaded at the proper location now. I'll have to check some code to find what's going on and fix that 4GB+ bug

DeletedUser14087 · Posted: Wed Jan 09, 2008 9:45 am Post subject:

an idea, instead of making it bootable, make it run at the host system, like vmware ws

Dark Byte · Posted: Wed Jan 09, 2008 9:55 am Post subject:

not possible because it needs to run on vista64.
and since we all know, vista64 won't allow you to run software

DeletedUser14087 · Posted: Wed Jan 09, 2008 10:10 am Post subject: