Cheat Engine

Teerayoot · How do I cheat? Reputation: 0 Joined: 08 Nov 2006 Posts: 6

After i double click at function in SDT entries such as i double click on

805C7D34

it bring me to address in disassembly windows but it will with 00 byte add [eax],al.

it 's same problem every function .

The address is valid after i observer in in WinDbg .
seem CE not correctly read the ntoskrnl.exe process .

ps . i using CE5.3 on my winxp sp2 oem version.

Dark Byte · Posted: Thu Nov 09, 2006 2:04 am Post subject:

is kernelmode readprocessmemory enabled in settings?

Teerayoot · How do I cheat? Reputation: 0 Joined: 08 Nov 2006 Posts: 6

Thank for interest in my post Dark Byte.

Kernelmode read/write processmemory are all enabled.

some function are correctly valid adress not!

example
after i dubleclick on
808DBC4A (5 parameters) - ZwReadVirtualMemory

in disassembler window bring me to

NtFreeVirtualMemory+130C
808DBC4A 00 00 add [eax],al

if i not attach CE as debugger ,memory are well read but address still incorrect.

Dark Byte · Posted: Thu Nov 09, 2006 2:55 am Post subject:

reopen the process 2 times without debugging (assuming kernelmode read/write is enabled)
that forces those functions to be used

Teerayoot · How do I cheat? Reputation: 0 Joined: 08 Nov 2006 Posts: 6

Thank you, it work now Smile