Cheat Engine

eax.qbyte · Last edited by eax.qbyte on Wed Apr 17, 2013 8:09 am; edited 2 times in total

Hi.
Problem when attaching windows debugger and VEH debugger.
I haven't tried kernel-mode debug.
Also the memory is not editable, not even after making page writable.
Stealth Edit can't do it too. CE memory hex editor shows "Protect Read/Write" but value is freezed
What do you think? why is that ?

Other notes:

can not attach windows debugger:5

Dark Byte · Posted: Wed Apr 17, 2013 2:42 am Post subject:

If memory can not be edited you must use kernelmode memory access (enable it before opening a process)
It probably won't fix the veh debugger, but you should be able to edit memory, or get the physical address and use a second ce to open the [Physical Memory] process and edit it there

eax.qbyte · Posted: Wed Apr 17, 2013 7:51 am Post subject:

Unfortunately I have access to no kernel stuff and my system doesn't support dbvm, do you have any other idea? I read somewhere some applications create a suspended debugging thread of their child processes and that way try to block that child process from being debugged and i think that method is being used here too. because the undebuggible process is child of a process that is debuggible.
But about memory write block that is not possible in parent process too, I tried to use WinHex to modify that address of ram but again not possible.
What kind of protection could have they used? is windows blocking the administrator of a PC from editing ram ? is that a fake trick ? is that possible to change it from windows security options ? :dizzy: