Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Debugger detection or something else with XCOM demo?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
jgoemat
Master Cheater
Reputation: 23

Joined: 25 Sep 2011
Posts: 264

PostPosted: Mon Oct 01, 2012 7:51 pm    Post subject: Debugger detection or something else with XCOM demo? Reply with quote

The demo for XCOM: Enemy Unknown is available now on Steam and I want to write a table for it, but the debugging tools "find out what accesses this address" isn't working well and I wonder if they're doing some kind of debugger detection which I've never dealt with before.

What happens is that it either won't display any results when I know the game is looking at the values (I change address and health bar updates on screen) or it will work for a little while and the game will crash with the window "... encountered error... blah blah, debug or not?"

In case anyone else wants to take a look, the soldier structure has an increasing timer at 01A0 set from the static at XComGame.exe+126587C by this code:
Code:
XComGame.exe+CAAA0 - 0F84 70010000         - je XComGame.exe+CAC16
XComGame.exe+CAAA6 - 39 87 A0010000        - cmp [edi+000001A0],eax --------------------- Timer
XComGame.exe+CAAAC - 75 0D                 - jne XComGame.exe+CAABB
XComGame.exe+CAAAE - 83 3D 84FA3A02 00     - cmp dword ptr [XComGame.exe+12AFA84],00
XComGame.exe+CAAB5 - 0F84 5B010000         - je XComGame.exe+CAC16
XComGame.exe+CAABB - 89 46 5C              - mov [esi+5C],eax


Other addresses are 01E0: Health, 01E4: Offense, 01E8: Defense, and I think 01FC: Will. That makes finding a soldier easy if you know their abilities and do an AOBSCAN. I've found two places that access the health before the game crashed, looks like they check for death along with other flags in the structure:
Code:
XComGame.exe+757B30 - 83 B9 E0010000 00     - cmp dword ptr [ecx+000001E0],00
XComGame.exe+757B37 - 7E 18                 - jle XComGame.exe+757B51
XComGame.exe+757B39 - F6 81 DC020000 18     - test byte ptr [ecx+000002DC],18
XComGame.exe+757B40 - 75 0F                 - jne XComGame.exe+757B51
XComGame.exe+757B42 - 83 B9 C8020000 00     - cmp dword ptr [ecx+000002C8],00
XComGame.exe+757B49 - 74 06                 - je XComGame.exe+757B51
XComGame.exe+757B4B - B8 01000000           - mov eax,00000001
XComGame.exe+757B50 - C3                    - ret
XComGame.exe+757B51 - 33 C0                 - xor eax,eax
XComGame.exe+757B53 - C3                    - ret


XComGame.exe+7BD1B0 - 83 B9 E0010000 00     - cmp dword ptr [ecx+000001E0],00
XComGame.exe+7BD1B7 - 7E 0F                 - jle XComGame.exe+7BD1C8
XComGame.exe+7BD1B9 - 83 B9 C8020000 00     - cmp dword ptr [ecx+000002C8],00
XComGame.exe+7BD1C0 - 74 06                 - je XComGame.exe+7BD1C8
XComGame.exe+7BD1C2 - B8 01000000           - mov eax,00000001
XComGame.exe+7BD1C7 - C3                    - ret
XComGame.exe+7BD1C8 - 33 C0                 - xor eax,eax
XComGame.exe+7BD1CA - C3                    - ret
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 471

Joined: 09 May 2003
Posts: 25832
Location: The netherlands

PostPosted: Mon Oct 01, 2012 7:54 pm    Post subject: Reply with quote

Try enabling VEH debugging instead of the windows debugger

if that doesn't help, disable the option to override existing breakpoints as th crash you describe sounds like one of the control breakpoints by the game itself is being removed

Also, you don't need to do an aobscan, a groupscan is a LOT easier (no hex)

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Botulism
How do I cheat?
Reputation: 0

Joined: 20 Oct 2012
Posts: 3

PostPosted: Sat Oct 20, 2012 1:03 pm    Post subject: I'm in the same boat. Reply with quote

Disabling the option to override existing breakpoints fixes the crashing, but the debugger doesn't detect any accessing or writing. Any ideas what to do now?
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 471

Joined: 09 May 2003
Posts: 25832
Location: The netherlands

PostPosted: Sat Oct 20, 2012 1:35 pm    Post subject: Reply with quote

in the debugevent window (memoryview) check which threads are constantly triggering unexpected breakpoints

Note them down and then go to the threadlist. Select all threads except those and choose the option to clear the debug registers

With luck the game won't crash instantly, and you will be able to find what accesses it
If still nothing, then clear the registers of the thread that is least causing the breakpoints, and you may have 20 seconds or less to find out what accesses it then before crashing. Hopefully proving you with the info you need

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites