Cheat Engine

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

Could someone please explain to me the method which CE uses to read and write to protected memory in another process (eg MapleStory.exe)

as ReadProcessMemory and WriteProcessMemory API's dont seem to wok on the protected memory.

Thankyou

Dark Byte · Posted: Sat Feb 17, 2007 4:28 am Post subject:

It uses it's own written Read/Writeprocessmemory api's . They are written in the .sys file and the stub (dbk32.dll) makes calling it as easy as the original api

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

Are the API's written "from scratch" or are they just normal Windows API's put into a single function?

Dark Byte · Posted: Sat Feb 17, 2007 5:33 am Post subject:

written from scratch inside kernelmode

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

so the kernal mode file runs as a driver then?
(im wanting my VB6 app to read/write to the protected memory)

abobrur · How do I cheat? Reputation: 0 Joined: 17 Feb 2007 Posts: 3

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

well, vb, as far as my research tells me, cant work in kernel mode, however if we are able to compile a dll of the kernel mode read/write process memory functions then we may be able to call it from within our VB interfaces.

any thoughts on this idea? - anyone?

Dark Byte · Posted: Mon Feb 19, 2007 1:45 am Post subject:

you can make use of the dll ce uses (dbk32.dll) that is a wrapper for the windows function to use my kernelmode functions.
OP=OpenProcess
RPM=ReadProcessMemory
WPM=WriteProcessMemory
any process can make use of this dll.

Problem is that gameguard detects the dll, and uce's have those names changed, so it'll take some time to figure out what is what... (Of course, I don't think wow is a problem here)

kkid28 · Posted: Mon Feb 19, 2007 1:54 am Post subject:

Why wouldn't WoW be a problem? No GG?

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

I was wondering about that, but i thought it might have been part of the main program, in which case i wouldnt have bothered trying to find the functions and extract them, however, now that i know it is include in a seperate file ill get a copy of Delphi and recompile the DLL with the names and functions changed.

I was about to start work on plan B which was to attempt to write a C++ DLL and then use VB to inject it into MS and use interprocess communication to "talk" to it.
The Idea behind the injection is if the DLL is operating in the same memory region as MS it may it may be able to access the memory values using normal win32 read/write api's... then again, it may not either....

kkid28 · Posted: Mon Feb 19, 2007 2:06 am Post subject:

I'm sure MS would have some protection over the basic commands used to read/write memory. I started learning ReadProcessMemory and WriteProcessMemory for C++ and it wasn't all that hard, then again maybe the people programming MS assumed people wouldn't know enough on how to make their own program to do this. Give it a whirl, if it works then everyone in the MS section will love you long time.

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

oh yeah, it does have protection, you can't use standard ReadProcessMemory/WriteProcessMemory API's, they just return 0.

Also tried VirtualProtectEx to see if that would allow the read/write API's to work... It didn't (either it doesnt work or i was calling it wrong)

However, if i get DarkBytes DLL to work, i will still attempt my DLL injection idea and post my results.

abobrur · How do I cheat? Reputation: 0 Joined: 17 Feb 2007 Posts: 3

Macka · Cheater Reputation: 0 Joined: 08 Oct 2006 Posts: 26

Having problems with the dbk32 DLL, I modified it and tried to call the modified functions from my trainer... got a Driver error "You are missing the driver. Please Reinstall CE......."

As per DB's instructions I put the dbk32.sys and kernaldata.dat with my dll, no change, still got an error.

I then tried using the original using the dbk32 DLL again, same error although this time my computer reset Laughing

any suggestions?

EDIT:
I just realised my modified dll returned a ProcessHandle when i called the open process function... the error still comes up.