Cheat Engine

[broly7]

Hello fellows!

I have a question, i'm using a dll to get injected into the Host process.
This DLL must be able to breakpoint an address (With INT3 breakpoints, cuz i heard you can use infinite of these)

Is this possible?
PBYTE($10000000)^:=$CC
I think this is the same as writing INT3, however this would break the execution, how can i handle this breakpoint exception, to check registers such as EAX,EDX,ECX etc?

I read many stuff about doing such things with an external debugger, but i'm working internally

Please if somebody could help me, even with another programming language, to breakpoint and check registers to the address i want...

[ulysse31]

If all you intend to do is check register why don't you simply hook the function where you intended to break initially and store the register's values in different variables ?

[atom0s]

If you are injected, you can use DebugActiveProcess to attach as a debugger to the current process. Afterward, you will need to manage the debug loop yourself. For that you will need to handle WaitForDebugEvent in a loop and process the debug events.

You cannot just write a 0xCC anywhere and expect it to do everything magically either. You need to save and restore the original data when the breakpoint is being handled in your debug loop. Otherwise, you are just going to crash the application.

As for reading the register data, you need to use:
- OpenThread
- SuspendThread
- GetThreadContext
- SetThreadContext (if you want to set things)
- ResumeThread
- CloseHandle

[Dark Byte]

only when not injected you can use the debug api as each event will freeze every thread, including the debuggerthread (no idea if the hidefromdebugger threadflag has an effect, but i doubt it)

when injected you're better off hijacking the exception (e.g exception handler hook, or a vectored exception handler)

cc breakpoints might sound easy, but there are some things to keep in mind like freezing all other threads, set the current thread to single step, resume and wait for the step and set the cc back , and resume the other threads (and not to mention multithreaded hell where two cpu's execute that instructions at the same time)

but, most importantly, what is the reason you're using breakpoints? If it is because editing the memory causes the game to terminate due to an integrity check, then cc breakpoints will be useless to you

[broly7]