| View previous topic :: View next topic |
| Author |
Message |
insus100
How do I cheat?
![]() Reputation: 0
Joined: 03 Mar 2022
Posts: 9
|
 Posted: Fri Mar 04, 2022 9:12 am Post subject: |
 |
|
| Dark Byte wrote: | Get the cracked version of the game, not only will debugging be easier, the game will most likely run smoother as well.
anyhow, to see why it crashes, go to memoryview->threadlist and expand the threads.
If the DRx values are not set to 0, that means the game makes use of the breakpoints, and if you replace them with your own, those breakpoints never get hit, and thus crash the game.
You can prevent that crash by going to settings->debugger options and disable "override existing breakpoints when setting breakpoints", of course, if the thread that accesses it also has those breakpoints set, you won't find anything.
To increase the odds attach the veh debugger to the game(using the processlist, NOT by setting a breakpoint), and watch mv->view->debug events
Play the game a little and see which breakpoints have been hit and which threads it occurs the most.
Then in the threadlist select all threads, except the one that triggers the breakpoint almost every second, and then rightclick and choose the option to clear the debug registers
With some luck you will have a few seconds before the game crashes, allowing you to find the code that accesses the variable |
Hey, sorry for bumping this old post but I'm having this exact same issue with Sleeping Dogs (the normal edition), looks like the devs left some hardware breakpoints in the game and when I attach the CE VEH debugger, it crashes the game whenever I try to use the "Find what..." functionability.
Sry for urls, it does not let me post them yet
Video demo:
youtu.be/yPOfb6Xc0xQ
It's true that it does not crash if I deactivate "Override existing breakpoints when setting breakpoints", but then nothing is shown in "Find what..." routines, even though it must show since the value is being changed by the game.
Now, I decompiled HKShip.exe in Ghidra, and managed to find CALL instructions to "AddVectoredExceptionHandler" as well as setting Dr (Debug registers) memory addresses, screenshots:
Change 0 to o, it does not let me post URLs for some reason
i.imgur.c0m/wXcju9D.png
i.imgur.c0m/61YhLUP.png
i.imgur.c0m/uyztGx2.png
i.imgur.c0m/Yn29qu0.png
I tried nopping the call instructions to these functions as well as skip the .Drx value assignment but it looks like it crashes just after launching the exe, not even the program window shows.
In your last post you said to "patch all the codes that rely on hardware breakpoints and emulate their behaviour". Could you elaborate on this?
And yes, I know the definitive edition doesn't have these issues (afaik, most likely the internal debugger was removed on release) but I prefer the normal edition and that's what I'm trying to hack.
Thanks for your help
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 475
Joined: 09 May 2003
Posts: 25989
Location: The netherlands
|
| Posted: Fri Mar 04, 2022 11:03 am Post subject: |
|
|
have you tried exception breakpoints?
also, if your system is compatible, you could try dbvm level debugging. That one also doesn't rely on debug registers
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
insus100
How do I cheat?
![]() Reputation: 0
Joined: 03 Mar 2022
Posts: 9
|
| Posted: Fri Mar 04, 2022 11:20 am Post subject: |
|
|
| Dark Byte wrote: | have you tried exception breakpoints?
also, if your system is compatible, you could try dbvm level debugging. That one also doesn't rely on debug registers |
I attached a screenshot with my settings.
It does not crash like this, but when using the "Find out what addresses this instruction accesses" in an instruction, it shows nothing even though it's accessing addresses.
I have Intel(R) Core(TM) i7-10700K CPU @ 3.80GHz 3.79 GHz
32GB ram, 64 bits. But there's an error when I try the dbvm debugger, I think I need to change something in UEFI but I'm not 100% where to find it. IT's an ASUS motherboard
It gives the following error: could not launch dbvm the intel vt feature has been disabled in your bios
EDIT: I went to uefi and enabled Intel VMX virtualization and looks like it's working fine for now, although when injecting some code my game crashed but I think it's cus I was debugging at the same time.
| Description: |
|
| Filesize: |
67.96 KB |
| Viewed: |
6926 Time(s) |
|
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Fri Mar 04, 2022 11:44 am Post subject: |
|
|
| insus100 wrote: | | And yes, I know the definitive edition doesn't have these issues (afaik, most likely the internal debugger was removed on release) but I prefer the normal edition and that's what I'm trying to hack. |
-I released a trainer for the original version years ago, but it was a real pain to work on because of the anti-cheat measures. Difficult to understand any preference over the newer releases unless you are intentionally trying to learn how to circumvent those. Nonetheless, I do know that I was able to attach the debugger, but it has been so long ago that I do not remember what steps were taken or how stable it was (probably not stable at all).
|
|
| Back to top |
|
|
insus100
How do I cheat?
![]() Reputation: 0
Joined: 03 Mar 2022
Posts: 9
|
| Posted: Fri Mar 04, 2022 12:09 pm Post subject: |
|
|
| ++METHOS wrote: | | insus100 wrote: | | And yes, I know the definitive edition doesn't have these issues (afaik, most likely the internal debugger was removed on release) but I prefer the normal edition and that's what I'm trying to hack. |
-I released a trainer for the original version years ago, but it was a real pain to work on because of the anti-cheat measures. Difficult to understand any preference over the newer releases unless you are intentionally trying to learn how to circumvent those. Nonetheless, I do know that I was able to attach the debugger, but it has been so long ago that I do not remember what steps were taken or how stable it was (probably not stable at all). |
Do you know if there's any weapon spawner for this game? That's what I'm trying to do rn, I found some functions related to the inventory class in Ghidra and right now i'm calling them but i don't know what parameters I need to give myself a rifle or a pistol.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Fri Mar 04, 2022 1:02 pm Post subject: |
|
|
There is a built-in spawner that the game uses, but I have not messed with it. I do have some weapon ID's, but this game has different ID's for different purposes, so I cannot say whether or not they will work. I am actually still working on a weapon changer feature, so I have not been able to look more deeply yet.
Have you had any luck spawning anything?
|
|
| Back to top |
|
|
insus100
How do I cheat?
![]() Reputation: 0
Joined: 03 Mar 2022
Posts: 9
|
| Posted: Fri Mar 04, 2022 1:15 pm Post subject: |
|
|
| ++METHOS wrote: | There is a built-in spawner that the game uses, but I have not messed with it. I do have some weapon ID's, but this game has different ID's for different purposes, so I cannot say whether or not they will work. I am actually still working on a weapon changer feature, so I have not been able to look more deeply yet.
Have you had any luck spawning anything? |
I didn't spawn anything yet but I found a function that looks like it registers "Natives" or something and there's function addresses, I will try to call them with parameters and see what it does.
| Description: |
|
| Filesize: |
34.04 KB |
| Viewed: |
6881 Time(s) |
|
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Fri Mar 04, 2022 1:40 pm Post subject: |
|
|
There are a lot of interesting things in this game that you can look at, especially in the earlier versions of Definitive Edition; it is a lot of fun. I would recommend ditching the original version, though, just so you do not have to deal with the anti-cheat nonsense.
Let me know if you are successful with spawning. I may dig into it eventually.
|
|
| Back to top |
|
|
insus100
How do I cheat?
![]() Reputation: 0
Joined: 03 Mar 2022
Posts: 9
|
| Posted: Fri Mar 04, 2022 1:57 pm Post subject: |
|
|
| ++METHOS wrote: | There are a lot of interesting things in this game that you can look at, especially in the earlier versions of Definitive Edition; it is a lot of fun. I would recommend ditching the original version, though, just so you do not have to deal with the anti-cheat nonsense.
Let me know if you are successful with spawning. I may dig into it eventually. |
Yes i'll keep messing around...
RN I'm using dbvm debugger and I have no issues, there's actually no anticheat but the developers just left an internal debugger (lol) and its hardware breakpoints will make it crash if you try to attach a normal debugger like VEH or windows (explained by drak byte in the second post of this thread). With dbvm all cheat engine functions work fine. I'll try to get rid of the internal debugger as well, although that will be more difficult.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Fri Mar 04, 2022 7:50 pm Post subject: |
|
|
| If I recall, the target prohibited any sort of injection (at certain locations).
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 475
Joined: 09 May 2003
Posts: 25989
Location: The netherlands
|
| Posted: Sat Mar 05, 2022 4:40 am Post subject: |
|
|
could be an integrity check.
you could use the dbvm cloak operation on the memory you're changing before running the script that changes it
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Sat Mar 05, 2022 5:11 am Post subject: |
|
|
Yes, it was most likely an integrity check. I used stealthedit since the CE cloaking did not exist at the time.
I do not remember much about the target, but a quick look at my previous work indicates that the checks may have only existed in specific regions of memory.
If I recall, this target was not online, but the anti-cheat may have been implemented due to internal DLC or some nonsense.
|
|
| Back to top |
|
|
insus100
How do I cheat?
![]() Reputation: 0
Joined: 03 Mar 2022
Posts: 9
|
| Posted: Sat Mar 05, 2022 9:02 am Post subject: |
|
|
someone posted about these integrity checks here a while ago:
/viewtopic.php?p=5464193
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
