Cheat Engine

[dobolz]

hi.. i'm new to CE
i wanna ask something
1. is there any standalone plugin for auto attach, coz some UCE didn't include auto attach function in their program.
2. hmm.. hard to explain bout thing that i wanna ask, so i tell in example..
process 0000618(854F86) calc.exe << something like this ( in proses watcher)

when i look in process list (long) there's another calc.exe.. so it became like this :
0000618 RF.exe
0000619 RF.exe
000061A RF.exe
000061B RF.exe

the thing that bother me is..
- what is 0000618 mean? PID?
- if PID.. how come there are 4 PID for 1 process?
- if some program hide the other PID.. how to reveal it? coz i got 1 problem i can see 0000618 RF.exe in process list.. but cant see the other 3 RF.exe in process list(long)

thx b4 for the answer

[Dark Byte]

1: no, and it's only half possible with a plugin (setting the processhandle), because the plugin system currently doesn't provide the option to enable the gui buttons and initialize the symbol handler. (The plugin system can enable the auto attach option in ce by writing the correct registry setting, but well, if the uce doesn't have auto attach at all, that won't help...)

2: yes, 618 is the processid (written hexadecimally)
that there are 4 is just the way windows handles the processid. Not really sure why, perhaps it always removes the last 2 bits of a pid ?

as for using hidden pid's: Use the option to manually enter the PID, or use the processwatcher window

[dobolz]

hmm... ok, i got the point..
but how can i attach manually by entering PID ?
(ex: RF.exe PID is 618, but i need to attach to 61A)

coz i notice that 618 is somekind of fake process n the process i need is at 61A

[Dark Byte]

in ce rightclick the processlist and choose the option to enter in the processid manually

[dobolz]

thx for the info.. ur the best dark

now i can bypass, but still working how to search the address
coz this time the game protector is really new... it's not working like other game protector that we've already know.. but it work like a rootkit... it can hide pid, change offset... etc