Cheat Engine

[Auburn_Azalea]

I've seen Dark Byte's posts and I wanted to do use them in my app.

From what I could gather stealth edit works by:
Enabling DEP on the remote process
Setting the VEH handler
Allocating a memory for the copy
Copying the contents from the module's start address up to its end address
And then finally, setting the module as read and write only.


But the result I got was the app crashing. I did extra checks on the app and it turns out there were stray relative calls. And so I installed capstone to disassemble and find the relative call, then fixing the copy version's call. I checked with CE and found that both the copy and original are calling the same address. But I still got a crash.

Here's the code:
pastebin id: WP9xfiK8

Any input would be appreciated. Thanks guys.

[Auburn_Azalea]

anyone?

[Dark Byte]

i assume the target is 64 bit?

did you adjust the riprelative addresses in the copy to point to the old location

[Auburn_Azalea]

Thank you for the response.