Cheat Engine

NoMercy · Posted: Mon Jun 13, 2011 2:38 am Post subject: Memory regions in kernel

Hello,

What I'm trying to do this is read the memory of a certain game. The anti-hack system hooks all RPM/WPM and things in kernel. So what I basically wanna do is reading phisical memory. I knew it was in the CE source so I did take a look there.

What I don't understand is the GetMemoryRegion() function, in user mode it's. VirtualQuery, but there? It's numbers, variables. I can't make my way in it. Is this the only way or are there easier ways?

I would need to do this right? I can't read non existing virtual address in phycial memory right? Or is that not even needed?

I've got a smaller question, nothing to do with the above, but the anti-hack system starts a driver etc, I thought what if I make all handles 0 for the driver. So it has no scanning anymore. Would this be possible? Or is it easier if you just completely destroy the driver? Side note the driver does not get called when in 64 bit, make the program think it's in 64 bit?

Thanks for reading,

NM

Dark Byte · Posted: Mon Jun 13, 2011 6:50 am Post subject:

http://www.intel.com/Assets/PDF/manual/325384.pdf
chapter 4
It describes the paging system (windows has the pages linearly mapped starting at 0xc0000000 )

(and you should see the virtual pagedir plugin plugin for ce which does something similar)

There are of course easier ways, but they are also easier to block

As for making all handles 0 (or -1) works sometimes (especially combined with faking it's running on 64-bit) but it might just as well cause the usermode program to selfdestruct because it can't launch the driver

Hooking the control commands send to the driver sometimes work, but that also can be blocked if there is a sequential encryption used

NoMercy · Posted: Mon Jun 13, 2011 8:11 am Post subject:

Figure 3.1.

The far pointer is my address. Let's take for example, 0x00400000. The pages starts 0xc0000000, so the offset is 0xc0000000 - 0x00400000?

EDIT: I've read this

Dark Byte · Posted: Mon Jun 13, 2011 8:45 am Post subject:

oops I meant chapter 4 in that pdf

assuming your system uses PAE paging: systems with no execute support or more than 4GB ram)

the pagetable entry describing 00400000 is at:
0xc0000000+(00400*8=2000 )=0xc0002000

the pagedir entry describing the pagetable:
0xc0000000+(0xc0002 * 8=600010)=0xC0600010

the pagedirptr entry describing the pagedir:
0xc0000000+(0xC0600 * 8=603000)=C0603000

first check the pagedirptr if the pagedir is present, then check the pagedir entry to check if the pagetable is prent, and then check the page table entry to see if the page is present.

if non pae mode is used, then multiply by 4 and there is no pagedir ptr table to check

more info:
http://wiki.cheatengine.org/index.php?title=Windows_internals

Often used code and data will usually not be paged out, but if you do need some code or data that is never accessed it will be a bit more tricky (but reserved bits can help, and obviously, it's not likely they contain anything you need)

NoMercy · Posted: Mon Jun 13, 2011 9:37 am Post subject:

Ok, thanks a lot, fater I've read lots of thing, I came up with the start of my own function with some things fmo CE source.

Dark Byte · Posted: Mon Jun 13, 2011 9:46 am Post subject:

NoMercy · Posted: Mon Jun 13, 2011 10:33 am Post subject:

Omg, thanks so much. I finnaly understand it. Reading 3/4 hours and I 100% understand it thanks. Needed to relearn some bitwise things etc. But bassically it starts at the begin and it goes on and on till the end has reached: MAX_PTE_POS. I've no idea what that value is. Something I've to accept instead of why? Page dir forumles etc.

Anyways, lovely. Now lets read some physical memory:)

Btw, why do you also write down the values? If you scan for a value, you all ready know it right(except for aob) ? And how do you write addreses to a file? sometimes its 400 and sometimes 4000, I'll have to make it 8 bits long, so x << 8. Something like that?

Dark Byte · Posted: Mon Jun 13, 2011 10:41 am Post subject:

For unknown initial values, and range values, and floating point values (1 is the same as 1.000000000000001 and 0.99999999999999999999 )

And for saved scans (e.g same as scan 3, or same as scan 4)

and I write down addresses using the pointersize (4 bytes/8 bytes depending on the version)
That way it's predictable where to seek the file pointer to when displaying the addresses at specific positions when scrolling (it's of course insane to actually write addresses to a listbox)

NoMercy · Posted: Mon Jun 13, 2011 10:53 am Post subject:

Dark Byte · Posted: Mon Jun 13, 2011 11:56 am Post subject:

no, just the address (base.exe will not change between scans)
with pointersize I mean that I write addresses to file in either 4 or 8 bytes (obviously not as a string)

as for the routine, I suggest adding some events to signal another thread that the scan is finished