Cheat Engine

[justa_dude]

Hi folks,

I just downloaded CE (5.6 release) today, and boy am I impressed! The tutorial alone is amazing. If Dark or other contributors reads this, by chance, please accept my sincere gratitude for a great tool.

So, having completed the tutorial I set off on my first "real" test. I launched a familiar game, alt-tabbed out and tried to "open" the process. CE crashed silently. I restarted CE, and tried to attach to the process instead. CE and the game both crashed. I've tried a handful of times now, and the results have been the same in each case. No error messages, no dialog boxes, no alert sounds - just a return to the desktop.

I googled for information (primarily using the keywords stealth and detection) and didn't really turn up too much information that seemed relevant and current. There were a few suggestions on some bugzilla threads, such as toggling the CE Kernel routine options in extra settings, but I've not met with any success.

I've used Artmoney (a similar, albeit much simpler tool) on the same process without any trouble, although I don't have any real idea on the methods it uses to read/write process memory versus those of CE.

My apologies if this has been asked before, but thank you for taking the time to read my query.

Cheers,
adude

[Dark Byte]

There are a few ways to fix this:
1: replace your windbg.dll in the system32 folder with a more recent version
2: Upgrade to vista or win7
3: Get the original non-cracked version of the game


5.6.1 which comes out really really soon will come with a updated windbg.dll for XP users

[justa_dude]

Wow! That was a FAST response! Thanks for the quick reply.

What provides the windbg system file, and would dropping an updated copy in the CE directory do the trick?

I totally forgot to mention what OS I was using, but you nailed it! haha. Would you mind describing what's going on for me and why the variables you mentioned would play a role?

Thanks again! This is awesome.

Cheers,
adude

[Dark Byte]

Windows xp comes with it's own version of windbg.dll (windows\system32) but I suspect the crack of that game is making use of an unpatched exploit to crash programs that make use of that dll, or it's debugging information is just so new that the outdated windbg.dll doesn't know how to handle it. (No idea if there's an windows update out for it, but for some reason people never do the windows update on xp... )

Dropping windbg in the ce folder has no effect as ce loads imagehlp.dll, which in it's turn loads windbg explicitly from the windows\system32\ folder (You could inject windbg.dll into ce with a dll injector BEFORE opening any process, since imagehlp is only loaded when a process is opened, and if windbg.dll is already loaded it doesn't re-load it)

as mentioned 5.6.1 will force load the updated dll automatically when loaded, but it's not yet released (still need to update the changes list)

[justa_dude]

Thank you, again, for the information.

I see that the windows debugging toolchain is available as part of the development sdk which I probably ought to download anyway (this is a relatively fresh Windows install). I wonder, however, how Artmoney is able to manipulate the process using the same system files. Or is it not necessary to invoke the debugging tools for basic read/writeprocessmemory calls? Could it be that the game is targeting CE specifically, rather than the underlying debugging engine?

You're obviously on top of the situation, so I apologize for the deluge of questions. I guess I'm just kinda' thinking out loud.

Thanks again for the awesome program and the speedy support!

Sincerely,
adude

[Dark Byte]

artmoney probably just doesn't make use of it. the imagehlp dll is only for the symbol support when using the disassembler

[Dark Byte]

you could try this version of ce:
http://cheatengine.org/download/CheatEngine561.exe

[justa_dude]

WOW! You probably get tired of hearing this, but you are THE MAN! It works a treat!

Thanks a billion, sir.

Regards,
adude

[ticofa2]

Hi, i also have the same problem, no matter the if i start the CE first and then the game, or the other way, CE always crashes, i tryed to do what you said exept i couldnt find any download of Windbg.dll, and the CE still crashes :S

PS: i also dont have any Windbg.dll file anywhere in my pc :S im so confused

[Geri]

Did You try to use it on more processes? If it is happening with one game only, it is probably detecting CE and shutting down because of that. This is a topic about an older bug which has been fixed in CE 5.6.1 already so it is useless to copy windbg etc.