Cheat Engine

[NoMercy]

Hello,

What I'm trying to do is to find a CRC check. I've tried to find out how it could check the memory which should not have been changed. I did some general API hooking on OpenProcess() and ReadProcessMemory() this are the results.
<censored>

I've no idea what it seems to do since it reads address 400000 with the size of 2, and the rest of the 004-00A does never get readed still if I change something = crash.

Maybe there are some other ways they could use?

Grz

[Dark Byte]

00400000 is generally not accessed, by integrity checks, but it will screw a game up (resources related)

I suggest finding the entry point of the game (first address shown in the disassembler when attaching ce to the process) and find out what reads that. (It's most likely NOT readprocessmemory but just local memory access)

One way to bypass that is enable the no execute feature of the cpu, mark the page you want to change as non executable, and hook the pagefault interrupt to change eip to a copy that you have edited

[Geri]

Or just modify the code that is reading the memory and feed it with fake info.

[gaming04]

Try jumping over the entire CRC Checking Procedure. Usually does not have any side-effect in the long run.

[NoMercy]

It's hard to find the CRC checks inside the laoded .dll because im on 64 bit-> I can't use CE's driver. Im trying to install win 7 32 bit on VirtualBox right now so I hope I can debug there and find the CRC checks. It seems that the protection loads his driver, to hide itself and make memory unreadable, gonna find a solution to not load his driver to-> check the APi's StartServicE() and stuff, seems they protect them very well.

Also DarkByte thanks for your post but I've no idea what your solution was, so I guess it will be impossible for me to make:(