Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


How to hide debug register dr7

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions
View previous topic :: View next topic  
Author Message
vitdor
Newbie cheater
Reputation: 0

Joined: 08 Feb 2018
Posts: 11

PostPosted: Thu Jan 17, 2019 12:22 pm    Post subject: How to hide debug register dr7 Reply with quote

Simple code SetThreadContext->GetThreadContext detects the debugger in global mode.
The driver gives fake registers dr0-dr3 but dr7 is always real. How to hide it?



img.PNG
 Description:
 Filesize:  13.29 KB
 Viewed:  312 Time(s)

img.PNG


Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 16

Joined: 01 Feb 2016
Posts: 1366

PostPosted: Thu Jan 17, 2019 12:39 pm    Post subject: Reply with quote

because global bits dont reset in global (unlike local), you should refer to intel's sdm.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
patched cheat engine tutorials
Back to top
View user's profile Send private message Visit poster's website
Dark Byte
Site Admin
Reputation: 360

Joined: 09 May 2003
Posts: 21246
Location: The netherlands

PostPosted: Thu Jan 17, 2019 2:35 pm    Post subject: Reply with quote

is the option to override existing breakpoints set ?
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Back to top
View user's profile Send private message MSN Messenger
vitdor
Newbie cheater
Reputation: 0

Joined: 08 Feb 2018
Posts: 11

PostPosted: Thu Jan 17, 2019 4:10 pm    Post subject: Reply with quote

Dark Byte wrote:
is the option to override existing breakpoints set ?

No, this is without an override.
If override is set, all registers will have 0x0 for the GetThreadContext function and debugging will also be detected.
If I comment out these 2 lines in interrupt1_handler(...)
//gpvalue=0xf0401;
//debugger_dr7_setValueDword(gpvalue);
DebuggerState.FakedDebugRegisterState[cpunr()].DR7=debugger_dr7_getValueDword();
dr7 can be hidden, but the target program writes to dr7 0xF0455 and I remain without debug registers Smile
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 360

Joined: 09 May 2003
Posts: 21246
Location: The netherlands

PostPosted: Thu Jan 17, 2019 5:24 pm    Post subject: Reply with quote

is this for singlestepping or for finding code that accesses imsomething? if just finding out try the dbvm version of find what accesses
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Back to top
View user's profile Send private message MSN Messenger
vitdor
Newbie cheater
Reputation: 0

Joined: 08 Feb 2018
Posts: 11

PostPosted: Fri Jan 18, 2019 2:41 am    Post subject: Reply with quote

Dark Byte wrote:
is this for singlestepping or for finding code that accesses imsomething? if just finding out try the dbvm version of find what accesses

This was done very simply, but effectively, when launched, the program writes fake addresses to the debug registers once (sets dr7 to 0xF0455), and then simply controls the changes through any exception and the _CONTEXT structure. Differences = debugger.

UPD
I found a way around this problem, but the method is not very elegant and situational. In the driver (IOCTL_CE_DEBUGPROCESS), the DR7 already appears with the value 0x400, the remaining registers retain their original state.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites