Cheat Engine

listito · Cheater Reputation: 0 Joined: 31 Dec 2010 Posts: 35

hey, is there any chance of "find out what writes this address" fail? 'cause i'm trying to see what writes into an address but nothing appears, how does this hook works?

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

Some debugger protections are doing that.
Btw. which debugger are you using?

listito · Cheater Reputation: 0 Joined: 31 Dec 2010 Posts: 35

i'm using vehdebugger

Dark Byte · Posted: Sat Dec 03, 2011 1:40 pm Post subject:

it can happen if all debugregisters are used up in the thread that accesses it. You could try kernelmode debug, but you may have more luck with 6.2+ and reset the debugregisters manually

listito · Cheater Reputation: 0 Joined: 31 Dec 2010 Posts: 35

Dark Byte · Posted: Sat Dec 03, 2011 7:53 pm Post subject:

no, multithreading has nothing to do with it.
All the debugregisters are just used up and ce is configured to not automatically override active debug registers (you have to do that manually as overriding debug registers can cause a crash if done on the wrong thread)

listito · Cheater Reputation: 0 Joined: 31 Dec 2010 Posts: 35

i think i'm gonna try it with 6.2+, where can i download it dark?

Dark Byte · Posted: Sun Dec 04, 2011 2:55 pm Post subject:

http://cheatengine.org/temp/CheatEngine62Alpha3.rar

attach the vehdebugger using the processlist (no active debugging just yet)
go to memoryview->view->debug events and go play the game for a minute or two (active playing)

If you have bad luck the list will be filled with several lines of breakpoints that got triggered. (If not, it's easy)

Now go to view->threadlist and select all the threads except the thread(s) that the event list showed you (if it showed none, just select them all)
Rightclick and choose "Clear debug registers"

Now set a breakpoint in the game and with luck it'll find it.

If not, and the list was not empty, you'll have to be prepared to crash the game (variable access happens in the thread that is actively using the breakpoints)

Select all the threads and clear the breakpoints, then set the breakpoint.
Go back to the game and try to trigger it as soon as possible (if possible, run the game in windowed mode and have it accessed constantly)
Due to the lack of handling of the breakpoint event the game will crash but perhaps after you've managed to get some basic debug information about the code that accesses the variable

And if all else fails, just go get the cracked version of the game