Cheat Engine

dnsi0

I just made a memory browser and looked at maple's memory after gg has inited. The strange thing is that the bytes in the memory keeps flipping through an order. Of:
Normal Bytes -> Strange Bytes -> Strange Bytes... etc and then back to Normal Bytes again. Why does this cycle repeat?

Heres a video on it:
http://ca.youtube.com/watch?v=tdt3-P_a6iM

... Ideas are welcome... T.T

Innovation · Posted: Sun Sep 28, 2008 2:23 pm Post subject:

Maybe GameGuard is mixing up the memory (I have no idea how) like HackShield does for Combat Arms.

dnsi0 · Posted: Sun Sep 28, 2008 2:26 pm Post subject:

Yea... But makeing it a cycle?? whats the point of that?

Innovation · Posted: Sun Sep 28, 2008 2:30 pm Post subject:

Maybe to make it almost impossible to edit?
It also could be the Memory Browser?

I guess we are going to have to figure out how get rid of GameGuard or else we won't be able to keep track of the addresses.

&Vage · Posted: Sun Sep 28, 2008 2:38 pm Post subject:

That is what we call polymorphic.

Slugsnack · Posted: Sun Sep 28, 2008 2:54 pm Post subject:

Not polymorphic that is where code changes. I have noticed this in some addresses in GB too. I assumed it was some form of 'encryption' or protection.

dnsi0 · Posted: Sun Sep 28, 2008 4:52 pm Post subject:

Does the entire memory change? Cause thats sort of hard to believe that gg would change the entire block of memory from 00400000 to 8FFFFFFF.

smartz993 · Posted: Sun Sep 28, 2008 5:57 pm Post subject:

Do a check to make sure RPM returned true. Also, you are using a driver to get past RPM hooks?

Dark Byte · Posted: Sun Sep 28, 2008 6:36 pm Post subject:

Could be a decryption/encryption. The game's memory is decrypted to execute and then when done re-encrypted again. Perhaps a few times you get to the the decrypted code and other times the encrypted.

and could also just be a bug in your reading (e.g forgetting to zero it before a read instruction)

pkedpker · Posted: Sun Sep 28, 2008 6:59 pm Post subject:

that is trimada unpacking its a packed exe file that unpacks from 1 MB to 7MB something.. it could also be some kind of pointers pointing to different addresses maybe values changing.. could be anything..

smartz993 · Posted: Sun Sep 28, 2008 7:19 pm Post subject:

Does CE get different memory than you? (constant)

Slugsnack · Posted: Mon Sep 29, 2008 4:13 am Post subject:

O yeah forgot Maple uses Themida. It decrypts a block of instructions then executes it, reencrypts, decrypts next block and repeats. That could be why.

dnsi0 · Posted: Mon Sep 29, 2008 5:04 pm Post subject:

No My program does not have errors. And Im not using drivers to bypass.

Oh ok. Themida reencrypts O.o I hate themida >.<

Dami · Posted: Thu Oct 02, 2008 11:22 am Post subject:

I suppose you used it on GMS...

Try it on ems, because ems is not protected with themida, at least you would find out if the problem is themida or something else :\

dnsi0 · Posted: Thu Oct 02, 2008 5:28 pm Post subject:

well... I cant. So Ill just give some1 the engine I used and get some1 to test it?