Cheat Engine

[Dark Byte]

The driver allocates physical memory, puts dbvm in there, and then forgets about it (basically a memory leak)
Then it saves the current state of the cpu , saves it to dbvm, and then exits windows and launches dbvm

It never returns from that, but dbvm will run a virtual machine based on the saved state of the cpu right before it exited windows.

anyhow, when the driver gets unloaded the physical memory it allocated for dbvm should not be freed by windows (it's a low level alloc and not specifically linked to the driver) and therefor will not be reused by anything else

of course, if you boot up with dbvm it will tell windows that the memory it's in belongs to the system firmware so windows won't touch it either

[predprey]