Cheat Engine

Corruptor · Posted: Wed Nov 14, 2012 11:20 am Post subject: Editing Library Functions

Something i always wondered about. From what i know, DLL's are loaded into the memory only once and every program that includes the DLL uses the same code, preventing pointless code duplication.

Now, if i open a program in cheat engine and decide to totally screw over the CreateWindowEx instruction, it's still totally fine to create any window in any other program; only when i try to do that in the program i opened in cheat engine, this and only this program will crash. Shouldn't every program be affected by this modification?

Gniarf · Posted: Wed Nov 14, 2012 12:06 pm Post subject: Re: Editing Library Functions

Dark Byte · Posted: Wed Nov 14, 2012 1:14 pm Post subject:

Gniarf is correct yes
As soon as you try to write a a page with the copy on write flag, a page fault exception will trigger. Windows then sees the copy-on-write, copies the page to a new physical address, remaps the pagetable entry for that page and sets it to writable, and then returns without giving an error.

Now, it is possible to make the modification affect every single process though. (with ce)
Enable kernelmode memory access in ce
Go to the address in the hexadecimal view and look at the physical address part and write it down
Go to the process list and select the top process named [Physical Memory]
Now go to the address you wrote down and edit there.
It bypasses the read only protection and thus doesn't incur the page fault, and no copy-on-write will happen, effectively editing the memory of all processes that have that module loaded at that specific location

--
Also, you can also edit the memory without causing a copy-on-write and without going to [Physical Memory] by editing the pagetable entry manually.
the pagetable entry can be found with this formula:
pagetablebase+(address/0x1000)*pageentrysize

in 32-bit the pagetabkebase is located at c0000000 and in 64-bit at fffff68000000000

in 32-bit the pageentrysize can be either 4 or 8 bytes, depending on if PAE paging is used or not. If no-execute support is in, PAE is enabled.
Normally you'd use getCR4() to check if the pae bit is set, but I didn't export that, so it's better to just check the first few entries of the pagetable first and see if you can determine what type it is

in 64-bit the pageentrysize is always 8

Anyhow, when you finally have the entry , change bit 1 (the second bit, RW) to 1