Cheat Engine

ducspam · Posted: Tue Oct 11, 2005 1:07 pm Post subject:

I did not include "IsDebuggerPresent" API when making the dubugger. I didn't know I needed it. I'll test it again when I get back home from work.

ducspam · Posted: Tue Oct 11, 2005 7:27 pm Post subject:

Ok, here is the output of the debugger. And it went all the way to the 4th stage, and said "isdebuggerpresent" and it return true.

debugtest

Dark Byte · Posted: Wed Oct 12, 2005 6:33 am Post subject:

Dark Byte · Posted: Wed Oct 12, 2005 6:34 am Post subject:

What you might want to check is when ce has been debugging the app and it dies go to memory view->view->debug strings.

perhaps it wrote some data to there explaining why it killed itself

ducspam · Posted: Wed Oct 12, 2005 7:25 am Post subject:

Nope, it did not write anything to the debug string.

So, now I have to edit the kernell32.dll to do the anti-debugger detection?

You know an easy way of doing this through the debugger? What values do I need to write to the address and so on?

Thy Gamer · Posted: Wed Oct 12, 2005 6:00 pm Post subject:

Is this in C++? Is there any way I can do this in VB6 or vb .net?

ducspam · Posted: Wed Oct 12, 2005 8:37 pm Post subject:

Yeah, you can do this in VB or VB.NET. I have been googling, reading up on the Windows API and also annoying the hell out of Dark Byte to figure some of this out.

I'm still googling and trying to find out how exactly do I patch the kernel32.dll with the debugger program I made. I guess one wrong move can mess up your computer.

So far, I got this out of W32Dasm:

Dark Byte · Posted: Thu Oct 13, 2005 3:17 am Post subject:

try:
WriteProcessMemory(processhandle,(PVOID)writeAddress,arraywith33c09090,4,NULL);

ducspam · Posted: Thu Oct 13, 2005 6:56 am Post subject:

Dark Byte · Posted: Thu Oct 13, 2005 7:59 am Post subject:

No, the processhandle is the processhandle of the process you are debugging
and the location of isdebuggerpresent is the same in the debugged proces as it is in your own app

Thy Gamer · Posted: Thu Oct 13, 2005 8:34 am Post subject:

ducspam, If you ever figure it out in c++ or vb, Could you help me out, kinda lost badly. Thanks if so.

ducspam · Posted: Thu Oct 13, 2005 9:53 am Post subject:

Sure, Thy Gamer.

When I get home, I'm going to test the anti-debugger detection with WriteProcessMemory on Dark Byte's debugtest app. Hopefully, it should tell me that I don't have a debugger attached.

Once that is done, I still have the Get/SetThreadContext, debug register, and exception event to deal with.

Thy Gamer · Posted: Thu Oct 13, 2005 4:43 pm Post subject:

ducspam · Posted: Fri Oct 14, 2005 12:18 am Post subject:

After the "WriteProcessMemory", it patched "IsDebuggerPresent". Tested this on debugtest and the 4th stage say it didn't find a debugger. (So patching was a success.)

But a new exception occurred when I debug the old process. I did DBG_EXCEPTION_NOT_HANDLE to every event except for CREATE_PROCESS_DEBUG_EVENT (just like you said).

Dark Byte · Posted: Fri Oct 14, 2005 3:16 am Post subject:

I have no idea. Are you sure you're not editing anything else in the game (e.g debug regs, etc?)