Cheat Engine

Alice0725

Many and many games use CEG protection and CEG protection uses many Anti-Debug tricks. If we can't anti-anti-debug, CheatEngine will be just a ptr-scanner.I'm a beginner of CE, is there some tuts or scripts of bypass anti-debug, like Geri's xLive dealer?

Dark Byte · Posted: Mon Aug 20, 2012 3:34 pm Post subject:

Usually I recommend to just get the cracked version of the game and play that. Added bonus is that you don't have to worry about behind the scene patches/updates, and the game will run a lot smoother (no more full module check each time you do something, no more breakpoints triggering slowing down the execution, etc...)

There are a few things you can do to bypass anti-debug things, but you'll need to have a good grasp of how debugging works and how the protection works.
E.g, if all 4 debug registers are in use, and actively triggered to cause code path changes, you must not touch those debug registers, or only do them when you can have the game crashing within 3 seconds.
Cheat Engine has a option to not override debug registers, when they are set, but you can disable that so it does override them.
Alternatively, you can check the threadlist and select the threads you only wish to set the debug registers in. (The debug event list in memview will show active breakpoints triggered not caused by ce, and the threads that caused them. Not resetting those will delay the crashes, of course, if it's the main game thread, you will have to do that)

Alternatively, if you're one of the lucky ones that can run dbvm, ultimap will show you the functions and paths inside them when doing specific things, like shooting a weapon or getting hurt. That information can be used to do a code injection to find the register values and go from there. (Tip, check out stealthedit plugin if the game uses an integrity check)

Alice0725 · Posted: Tue Aug 21, 2012 2:23 am Post subject:

-----------------------------------------------------

DBVM-Debug

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: 3b
BCP1: 0000000080000004
BCP2: FFFFF80002A96602
BCP3: FFFFF88002899230
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\082112-7129-01.dmp
C:\Users\Alice\AppData\Local\Temp\WER-14118-0.sysdata.xml