View previous topic :: View next topic |
Author |
Message |
oOSpikeOo How do I cheat?
Reputation: 0
Joined: 17 Oct 2013 Posts: 6
|
Posted: Thu Oct 17, 2013 3:06 am Post subject: Baseaddress access denied |
|
|
Hey,
with cheat engine i can find the baseaddress of many programmes, but if i try to find addresses of engine.exe the programm hang cause error like this: no accessable memory. If i check all checkboxes at Settings->Extras it works fine.
Now my problem ... if i try to get data from many games it works fine with my vb.net programm. But if i try to get the baseaddress of engine.exe i get access denied Error.
Any one know how to get the baseaddress? Windows 7 64bit VS2010 VB.Net
Thx Spike
Description: |
|
Filesize: |
32.11 KB |
Viewed: |
14904 Time(s) |

|
|
|
Back to top |
|
 |
oOSpikeOo How do I cheat?
Reputation: 0
Joined: 17 Oct 2013 Posts: 6
|
Posted: Fri Oct 18, 2013 6:54 am Post subject: |
|
|
Code: | DWORD BasePointer = SearchPattern("8B 4D 08 0F B6 51 04 A1 x x x x 89 90 x x x x",0x00400000,0x007FFFFF); |
how can i search for this pattern in vb.net. Any hint for me ?
Thx Spike
|
|
Back to top |
|
 |
DELETED_USER Newbie cheater
Reputation: 1
Joined: 02 Oct 2013 Posts: 24 Location: Venezuela
|
Posted: Fri Oct 18, 2013 11:27 am Post subject: |
|
|
Did you run it as Admin?
And the pattern can be found with the ReadProcessMemory API.
|
|
Back to top |
|
 |
oOSpikeOo How do I cheat?
Reputation: 0
Joined: 17 Oct 2013 Posts: 6
|
Posted: Fri Oct 18, 2013 1:26 pm Post subject: |
|
|
Yea i run this programm as admin.
Code: | BOOL WINAPI ReadProcessMemory(
_In_ HANDLE hProcess,
_In_ LPCVOID lpBaseAddress,
_Out_ LPVOID lpBuffer,
_In_ SIZE_T nSize,
_Out_ SIZE_T *lpNumberOfBytesRead
); |
i need the BaseAddress for the readprocessmemory api ... thats why i try to get the Baseaddress via this pattern. But thats the problem i dont know how to search 40000-7FFFFF for this pattern. It should between there.
|
|
Back to top |
|
 |
DELETED_USER Newbie cheater
Reputation: 1
Joined: 02 Oct 2013 Posts: 24 Location: Venezuela
|
Posted: Fri Oct 18, 2013 10:03 pm Post subject: |
|
|
oOSpikeOo wrote: | Yea i run this programm as admin.
Code: | BOOL WINAPI ReadProcessMemory(
_In_ HANDLE hProcess,
_In_ LPCVOID lpBaseAddress,
_Out_ LPVOID lpBuffer,
_In_ SIZE_T nSize,
_Out_ SIZE_T *lpNumberOfBytesRead
); |
i need the BaseAddress for the readprocessmemory api ... thats why i try to get the Baseaddress via this pattern. But thats the problem i dont know how to search 40000-7FFFFF for this pattern. It should between there. |
lol, what do you exactly need? because I can't understand all you've wrote.
|
|
Back to top |
|
 |
oOSpikeOo How do I cheat?
Reputation: 0
Joined: 17 Oct 2013 Posts: 6
|
Posted: Sun Oct 20, 2013 2:25 pm Post subject: |
|
|
You are right. My misstake... i used readproccessmemory in a for loop and list the result (Bytes). It works on Solitaire.
But if i use it on "engine" i get LastErrorCode 5 = Access denied
|
|
Back to top |
|
 |
DELETED_USER Newbie cheater
Reputation: 1
Joined: 02 Oct 2013 Posts: 24 Location: Venezuela
|
Posted: Sun Oct 20, 2013 11:38 pm Post subject: |
|
|
Look child... when you ask for help, you should GIVE enough information.
Anyways, in your case, I've seen the window name "KalOnline", and then I've downloaded the game just to try do what you're trying to do.
When I start the game, something shows, something that we could call a "game protection"... in the attachment you can see it.
So... if a game protection is running, the memory of the process of the game can't be modified easyly. Something should be protecting it, it could be a driver, and then... you should think how to jump this kind of protection.
So, from here... I can't help you more, I have lot of things to do, is your turn to learn about deep programming, it's time to you to learn how windows works in the inside.
If you really want to modify the data (or even read it), you should begin to learn the advanced stuff inside the Windows programming.
As I said: learn to walk, before run. (Nobody will give you the code to jump the protection, you must learn how to do it by yourself)
Regards, happy learning.
Description: |
|
Filesize: |
54.38 KB |
Viewed: |
14713 Time(s) |

|
|
|
Back to top |
|
 |
oOSpikeOo How do I cheat?
Reputation: 0
Joined: 17 Oct 2013 Posts: 6
|
Posted: Mon Oct 21, 2013 8:36 am Post subject: |
|
|
LoL i dont want running code ... i can scan engine.exe with cheat engine if i check all extras ... i want to understand what´s the different! But i wrote it in my first post.
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25788 Location: The netherlands
|
Posted: Mon Oct 21, 2013 8:43 am Post subject: |
|
|
The extra features make use of a kernelmode driver.
Instead of the API provided by windows (ReadProcessMemory/WriteProcessMemory/OpenProcess/VirtualQueryEx) it implements it's own version, ignoring the security checks and other things
To do the same as cheat engine, you will have to write a driver yourself (or compile ce's one and use that. Either unsigned and boot with unsigned driver support, or buy a business class certificate to sign your own compiled driver)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
 |
oOSpikeOo How do I cheat?
Reputation: 0
Joined: 17 Oct 2013 Posts: 6
|
Posted: Wed Oct 23, 2013 9:14 am Post subject: |
|
|
Is there any documentation about "how to" use the ce´s driver ?
|
|
Back to top |
|
 |
DELETED_USER Newbie cheater
Reputation: 1
Joined: 02 Oct 2013 Posts: 24 Location: Venezuela
|
Posted: Wed Oct 23, 2013 10:05 am Post subject: |
|
|
oOSpikeOo wrote: | Is there any documentation about "how to" use the ce´s driver ? |
At SVN you can get the source code. What else you want?
|
|
Back to top |
|
 |
gir489 Grandmaster Cheater
Reputation: 14
Joined: 03 Jan 2012 Posts: 841 Location: Maryland, United States
|
Posted: Thu Oct 24, 2013 11:28 am Post subject: |
|
|
It looks like the area of memory is protected. Try removing the page flags.
|
|
Back to top |
|
 |
DELETED_USER Newbie cheater
Reputation: 1
Joined: 02 Oct 2013 Posts: 24 Location: Venezuela
|
Posted: Thu Oct 24, 2013 12:09 pm Post subject: |
|
|
gir489 wrote: | It looks like the area of memory is protected. Try removing the page flags. |
How could him do it in user-mode if a driver is protecting/hooking it?
|
|
Back to top |
|
 |
|