View previous topic :: View next topic |
Author |
Message |
winfredchen How do I cheat? Reputation: 0
Joined: 05 Dec 2006 Posts: 4
|
Posted: Wed Dec 17, 2008 8:09 am Post subject: How to use DBVM? |
|
|
I boot from DBVM CD-ROM ,
when it process to
"vmloader finished. Switching from 32-bit to 64-bit and entering VMM"
"Press any key to continue"
I press a key, then my computer reboot....
Any step I miss?
--Update------------------------------------------------
When I switch to DBVM 0.5,
the problem solved!
thanks!
Last edited by winfredchen on Wed Dec 17, 2008 7:07 pm; edited 1 time in total |
|
Back to top |
|
|
Dark Byte Site Admin Reputation: 457
Joined: 09 May 2003 Posts: 25262 Location: The netherlands
|
Posted: Wed Dec 17, 2008 1:58 pm Post subject: |
|
|
as you figured out, the beta works better/more stable.
And how to use it: When it's loaded you can make use of vmcall instructions to give commands like hooking int1, changing segment registers to kernelmode, etc...
CE5.4 makes use of it by hooking int1 so it's invisible hooked
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
|
winfredchen How do I cheat? Reputation: 0
Joined: 05 Dec 2006 Posts: 4
|
Posted: Thu Dec 18, 2008 2:48 am Post subject: |
|
|
Code: |
if (vmxusable)
{
DbgPrint("using VMX idt1 bypass\n");
__try
{
vmx_redirect_interrupt1(1, 0, NewInt1.wSelector, (DWORD)&interrupt1); //idt bypass hook
}
__except(1)
{
DbgPrint("VMX idt1 bypass failed\n");
return FALSE;
}
}
|
Thanks Dark Byte,
I also have some question about the DBVM!
Dose that means it will redirect int1 to new intvector 0 (int0)
and will handle by function "interrupt1"?
So that CE raise interrupt using int0, and catch by CE self then bypass idt1 hook and idt1 restore check?
|
|
Back to top |
|
|
Dark Byte Site Admin Reputation: 457
Joined: 09 May 2003 Posts: 25262 Location: The netherlands
|
Posted: Thu Dec 18, 2008 11:14 am Post subject: |
|
|
Well, that function call is kinda tricky to read and I should probably split it up into 2 functions.
first paameter is the redirecttype.
Type 0: When an interrupt occurs it just spawns the interrupt provided in the 2nd parameter is used.
Type 1: When an interrupt occurs it emulates an interrupt event (sets the proper flags and pushes the state on the stack) and changes CS:EIP to the address you've provided.
So in this case when an interrupt happens it just jump to the driver's interrupt1 routine, and on exit either jump back using an iret, or jump to windows' original interrupt1 handler
all without even touching one byte in the interrupt table.
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
|
|