Cheat Engine

rapion124

I'm trying to unpack this program. I need to use hardware debuggers to debug it because it does CRC checks so int3 breakpoints will get detected. But, the program somehow always clears the DRx registers, causing my breakpoints to fail. I'm thinking it uses the SEH to do this because there are a lot of access violations and then the breakpoints disappear. I put an int3 breakpoint on SetThreadContext, but it never gets a hit.

How do I prevent this so I can debug the program? Btw, the packer is like a custom packer.

Flyte · Posted: Sun Jul 06, 2008 1:09 am Post subject:

Hook ZwContinue().

Dark Byte · Posted: Sun Jul 06, 2008 8:27 am Post subject:

or hook the interrupt1 handler in kernelmode (might require dbvm if it also checks the IDT in kernel for changes)
then set the global debug flag in DR7, and each time it is read to or written to, it'll break, and you can fake the edit
keep in mind that with this method you'll be processsurfing, since each taskswitch will cause a DRx access, so check which process before you set the breakpoint to break on something.