Cheat Engine

[gamesguru]

Dark Byte...debug registers are used a lot...but I've never seen you really explain how they work and how you did it in CE. Could you explain it a little please?

[Dark Byte]

what are debug regs:
Debug registers are special cpu registers that can cause a interrupt 1 interrupt to fire on a special condition. You can set that condition with debug registers.
You can set it to raise that interrupt on a execution of some code
On a write of a specific address
and on a read/write of a specific address
(there is no read only possibility, so use you brains when looking at the instruction that accessed it)

You can even let it raise a interrupt 1 when the debug registwers are being read or written to. But ce 5.3 doesn't make use of that function.
And in the past you could set debug registers so global, so they would work for all tasks, but since the early pentium cpu's that functionality got removed

How does ce (ab)use them:
Cheat Engine can set those debug registers for you. Rightclick the address in the list and it'll set the proper debug register states so it raises that interrupt on a read or write. (assuming you've configured ce to use debug registers, default, except vista)
The change registers at address option does the same, it configures the debug registers to raise the interrupt on execution of the specified address. Then it can edit the registers and continue as if nothing ever happened.

CE has 2 methods of catching interrupt 1's using the normal windows api:
Interrupt 1 gets passed to the normal windows handler, that one checks if there is a debugport , if so , pause the process and send the event to the debugger (ce) and there I can handle it. (if not raise a exception, and if not handled by the application terminate)

Interrupt 1 gets captured by ce's device driver, there it's checked if the interrupt 1 actually belongs to the target process and if it was caused by ce, and if so, handle it internally in the driver and quickly exit, not letting windows know a interrupt ever happened. If it wasn't caused by ce it just calls the original handler of windows to let it do it's course


Hope that explains it better