Cheat Engine

[n1vX]

Hello All,

Can we use DBVM Cloak to cloak this selected memory region?
How to make it possible using lua ?

[Dark Byte]

Assuming you wish to do this to hide the program, then instead I recommend hooking the kernelmode API responsible for reading process memory,(use dbvm cloak for that) and hide that memory by making it return garbage if it's the specific memory region

You can even detour the OpenProcess call so it fails to open or opens a dummy process instead

If you do insist on using the dbvm cloak to hide ALL that memory, then you must first add 0x9662000*processorcount bytes to DBVM
So if you have 8 logical cpu's then you'll need to add 1.2GB RAM to DBVM
Then do a dbvm_cloak on every page and mark then write garbage to the code

---

If you're asking to use cloak to bypass a integrity check routine in that process then just cloak the pages you are actually going to change, and not more

[n1vX]

Thank you Dark Byte, I just want to bypass integrity check.

[Dark Byte]

then find the address you wish to change and do something like:

[n1vX]

Thank you for your help, Dark Byte.

[n1vX]

Hello Dark Byte, everything has work perfectly if only I open single process. But the problem comes when I open game again (two process same game), memory cloak is done but it won't be executed.

I read this note on celua but still don't understand

[Dark Byte]

ok, so same process running multiple times.

In that case both processes will have the same physical address for the code, until something triggers the copy-on-write

The most efficient way would be to look for a codecave inside the game's module that you can use and jump there. That way you only need to apply the dbvm cloak on one process and it affects the current and all future versions until disabled.

But since that is tricky I recommend just doing a single

[n1vX]

Thank you Dark Byte.

Finally I found the problem, if the game run in multiple and I use dbvm cloak in all those games, It change physical address after several minutes.

I just need to disable cloak then get new physical address and cloak it again.

But the problem still there.

I manually cloak 4 addresses then after several minutes, tried to disable it one by one, only 3 got disabled and 1 still cloaked and stuck, and I cannot assemble anything to that stuck cloaked address. In memory viewer the bytes still green.

[Dark Byte]

if disabling is an issue then try

[n1vX]