Cheat Engine

[L0WC04T]

Hello friends,

I am trying to debugg a single player game with this awesome tool! The problem is that if a specific region of code is reached (whenever my i am ingame and alive) the presence of the debugger crashes the game.
The same thing happens with other debuggers like ollydbg, but I found a plugin that allows the debugger to be present without crashing. The option for it is called "custom handler exceptions" so I think this is some kind of a debug mechanism that causes an exeption and tries to handle it, whenever it is not handled (swallowed by debugger / cheat engine) it causes the game to crash.

I found an intresting paper describing this technique here:
anti-debugging-with-exceptions.pdf (can't post urls yet sry, just google it)

My question:
is there any way to defeat this with cheat engine? Because I love the features of cheat engine and really want to use it! Thank you all very much in advance!

[Dark Byte]

use the VEH debugger interface in settings->debugger interface as the windows debugger is useless, and I only recommend kernelmode in very specific cases
Also, make sure you uncheck handle debug events not caused by cheat engine (it's unchecked by default, but just in case)

[L0WC04T]

hi, thank you very much, i aleady tried the VEH debugger with the same results, and i can't find the option "handle debug events not caused by cheat engine", i searched everywhere :S

also i found the ptOnDebugEvent function, should i use it to pass the event to the program instead?

[L0WC04T]

I can't find the option in cheat engine 6.4
spoonfeed pls

[Dark Byte]

nvm that's an old option that is already disabled by default.
Anyhow one important option to disable when getting crashes is :"override existing breakpoints when settings breakpoints"

Also, there are multiple reasons a target can crash.
1: Dll injection fails (VEH debug injects a dll)
2: It unloads the injected exception handler (it only has to try 2147483647 different addresses in a 32-buit target to unload it, and then only on executable memory, so actuially just a handful)
3: The game uses the debug registers itself, and adding a breakpoint will override them, causing the breakpoints to not get handled)

There are a few things you can test to figure out what goes wrong
1: Inject a dll (just tick speedhack) if it crashes, there is a dll injection issue
2: Before targeting the process go to memoryview->view->debug events
Then from the processlist click on "attach debugger to process" NOT OK, and do NOT set any kind of breakpoint
See if the event list gets filled with debug output, or if it stays empty
if it stays empty the handler isn't receiving anything

3: If you set a breakpoint and it crashes, make sure you actually did disable the option to override breakpoints.
If it doesn't crash but you're not getting anything, then all debug registers are used up
It could also be it's just checking the debug register state and crashes because of that

4: If you've limited down the problem that setting the breakpoint is the issue, go to settings and set the prefered breakpoint method to "Page Exception"
These breakpoints to not use hardware breakpoints so even if all 4 of them are in use by the target, you can still use them.
Their downside is that they can be glitchy, and are extremely slow. (They mark at least 4096 bytes as read only, or non readable and handle every access in a single thread)