Cheat Engine

[Viloresi]

So using GetThreadContext the veh debugger can be detected easily, but the kernelmode one can't...
If I open the view showing threads of the process that I'm debugging with cheat engine, with the kernel debugger debugging it shows that debug registers aren't touched at all.
Just how is it possible?

Edit: to be more precise it happens when I enable global debug, with global debug disabled registers can be seen changing

[Dark Byte]

With kernelmode debug and global debug enabled CE's driver will take full control of the DR registers
Reading from and writing to the DR register will cause the driver to be invoked which then emulates the read/write instruction hiding the debug registers it has set

[Viloresi]

Thank you.
P,.s. I have another question but I make another thread to avoid going offtopic