Cheat Engine

[listito]

It's not CE,

I'm just using CE to play with some game which is packed with themida and i think that's the problem, i attach the debug with success, it's needed to search while game is paused, but when I try to know what access the address the game crashes , and i REALLY need to know what access that address..

Can you guyz point me something to do related to it?

[Geri]

If You are using 32-bit op system, try it after You have enabled these options:

With these options:
Use kernelmode debugger.
Use Global Debug routines.
Try to prevent detection of the debugger
Handle breakpoints not caused by CE (this is not neccessary in most cases but who knows)

[listito]

got win7 64

[Geri]

That sucks. But VEHdebugger with CE 6 may work.

[listito]

hey can you link me this vehdbg? is it a plugin?

[Geri]

It is not a plugin. It is a new debugger function in CE 6.

Probably the game will still crash with VEHdebugger too, but just AFTER the breakpoint has been reached. So the game will crash, but You will have Your address.

Or if You are lucky, it will not crash at all. Depending on the protection.

[listito]

IT WORKS!

i'm just amazed with this new "find out what writes to this address" it's very impressive showing the number of times

good job to the ones who did this thing, very nasty

[Geri]

Yeah, pretty cool.

[listito]

perhaps, is there a way to use this vehdebugger with olly?

what is it exactly?

[Geri]

Well, it is a dll so probably it can be implemented into other programs but no idea about olly. Maybe as a plugin or something. Dark Byte will know it I guess.
However olly doesn't have a tons of features that CE has already so for gamehacking, olly is almost useless compared to CE.
Really, CE 6 has much more sophisticated debugger options compared to CE 5.6.1.
You can already set data breakpoints, create conditional breakpoints, improved the Break and trace, improved the "find out what..." features, basically everything has been improved.

[Dark Byte]

It's possible, but might probably be easier to recode from scratch

vehdebugger registers an exception handler and on exception sends a message to ce's veh debuggerinterface
That will then convert the exceptions into windows standard debug messages and passes that on to the debugger

[listito]

that means you overwrite all SEH's to not let the application crash?

[Geri]

Vectored Exception Handling
http://msdn.microsoft.com/en-us/library/ms681420(v=vs.85).aspx

Interesting stuff.

[listito]

hey dark byte,

i'm using CE6 and was trying to search an unknown initial value, so far so good, but when try to search for unchanged value and click in next it gives an error that i dont remember now but later i'm going to check that out again

[Dark Byte]

make sure you have at least 32 GB diskspace free on the disk where the tempfolder is

32-bit:
assuming a 2GB process, 4 byte scan, not a single byte was changed and no fastscan:
2GB for first scan results
results generate 8 bytes/changed address (address+4 byte value)
so 8*2=16 GB

and if you do a next scan then the undo file for that needs to be generated: again 16 GB plus the new results (so lets say unchanged again and nothing changed again : 32GB


in 64-bit multiply by 2: 64GB