Cheat Engine

[chASM]

Hey,

As most know, Windows Vista x64 and Windows 7 x64 (perhaps even XP x64, never used it) do not support unsigned drivers for security reasons.

CE 'requires' DBVM in order to use the kernel debugger under these operating systems, or one can sign the driver themselves (according to Dark Byte with an expensive certificate).

There is, however, another sort of certificate which allows one to load and use drivers that are not signed. One can switch Windows into 'test signing' mode, generate a code signing certificate, register it and 'test sign' the driver. This is meant for debugging purposes but should also allow ANY unsigned driver to be test-signed for the specific system it is to be executed on.

Doing this with dbk64.sys results in a BSOD with a SYSTEM_SERVICE_EXCEPTION (STOP: 0x3B).

Since I have coded and still code many a driver (part of that little thing called 'work'), I know this test signing works great if the driver is 'proper'. I have not gone over the code of dbk64.sys or even compared it to dbk32.sys code-wise, but I did notice that the 64 bit driver is smaller than the 32 bit driver. 64 bit usually results in executables/dlls/drivers that are larger than their 32 bit counterparts in size. So I assume that dbk64.sys is 'optimized' for DBVM (which I can not run for security reasons, even at home, due to that thing called 'work').

Any chance of getting a dbk64.sys that is just a driver and does not rely upon DBVM so that I can test the test-signing process with it? Or, if it does not rely on DBVM, investigate the BSOD and see if it can be fixed.

Oh, before I forget.

I did sign the dbk64.sys with a real certificate (Verisign in this case) from the pool we have at work, as a test. This doesn't work either. Pretty much the same result as above.

Regards,

chASM

PS: If the test-signing works, I have a small tool that will perform the switch to test signing mode, certificate creation, registering the certificate and test-sign a driver, making it easy to do this (as this is not all that easy to do normally). I would, of course, modify it for CE usage specifically. Might also have to remove some desktop watermarks that show up as a result of the test-signing mode (albeit that seems to happen under Vista only), an easy thing to do (apart from having to rebuild the MUI cache), by simply removing the watermark text from the Windows DLL.

[Dark Byte]

Yes, 64-bit requies dbvm for kernelmode debugging(invisible interrupt hook). For just memory access having the driver signed suffices.

Also, the driver can load dbvm , but your system needs to be compatible

Only way to use this without dbvm is disabling patchgurd,but if you go that far you wouldn't even need to sign (replaced kernel)


As for the size, this is mainly due to some code completely missing from the 64-bit version (api hooks, non pae pagetable handling, etc...)