Cheat Engine

stefkeh · Cheater Reputation: 0 Joined: 29 Mar 2006 Posts: 39

Hi everyone,

i am trying to bypass a crc function so i unpacked the exe ,
scanned it with ANALyzer and it returned me 1 CRC32 function
with the following addresses:

atom0s · Posted: Mon Feb 28, 2011 12:56 pm Post subject:

Keep in mind that ANALYZER doesn't always give true results and will assume things based on patterns. A chunk of code that has nothing to do with encryption or hashing could be detected as one just because of the pattern etc.

Your theory is one of a few possible methods to handle bypassing the check. You could also fake the return of the function and ignore the check all together depending on how the function is written. Or you could just force the game to compare against the memory it wants to scan against itself so it will never be different.

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5636

This is not exactly like what You are looking for but it may help in finding a working method:

http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles/243-xlive

stefkeh · Cheater Reputation: 0 Joined: 29 Mar 2006 Posts: 39

ok will have a look Smile

thanks everyone !

oh and if someone has a nice explanation on how to bypass crc i would be more then happy to hear it Wink

thanks !

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5636

My article is basically about this in short.

1. Find the function which is reading the memory by setting a breakpoint.
2. Disable the function.

The solution can be different in every case but the idea can be used to bypass more programs. Actually it is not even an idea, it is just simple debugging.

stefkeh · Cheater Reputation: 0 Joined: 29 Mar 2006 Posts: 39

ok thanks alot Geri,
now i'll just have to find out how to attach the debugger without beeing detected.

thanks !

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5636

If you use 32-bit OS, CE's kernelmode debugger will be most likely undetected, which is a very easy solution. VEHdebugger is also undetected by most protections and it is working on 64-bit too.

If you plan to use another debugger, you need to be creative a bit but Olly for example also has some plugins to hide the debugger.

Still, as you can see, the memory scanning can be disabled in a few minutes using CE only, as in my article. It isn't difficult at all.

stefkeh · Cheater Reputation: 0 Joined: 29 Mar 2006 Posts: 39

yea i am using a 64 bit sys, i'll see if i can manage to find the crc check with the VEHDebugger, otherwise i'll setup a vm to checkout the CE Kernel.

oh and i love your tutorials ! really a piece of art ! Smile

good job on those mate !

grtz