Cheat Engine

[systrojan]

Hi Dark Byte,

I tried to search game process on vmware with CE, but CE only read vmware process on their memory.

Can u explain to me how can do that? i mean CE can read the other process in vmware-vmx ?

note: i use vmware workstation 7.1 with windows sp2

Thanks in advanced

[Dark Byte]

I have no idea, perhaps you can find the base of the physical memory, then the base of the loaded windows kernel, from there try to find the eprocess list, and in there find the CR3 address of the specied process
Then use that and the relative addresses to map the virtual addresses to physical addresses and back to virtual again and read that

[systrojan]

LoL.. too many jumping process..

Thanks a lot, i will try it

[Dark Byte]

for those interested to implement this, here's a easy trick to get the physical address memory region:
Use virtualqueryEx to find all memory regions and look for regions with the type "mapped"
then for each mapped region find the filename (GetMappedFileName) the region with extension .vmem is the physical memory of the virtual machine

[SER[G]ANT]

Just run CE on VM