Cheat Engine

[lcineyes]

1.​​DBVM Mode Stability Issue​​

When using DBVM mode instead of IPT mode, the system consistently experiences Blue Screens of Death (BSOD).

2. ​​IPT Mode Limitation​​

The current IPT (Intel Processor Trace) implementation cannot properly handle self-modifying code. Are there more robust alternative solutions available?

[AylinCE]

General Description: Problems and some solutions.

DBVM Mode Stability Issue (BSOD) Solution:

DBVM (Direct-Bypass Virtual Machine) mode is a virtual machine technology used in Cheat Engine to provide deeper access to the Windows kernel level. However, this mode can lead to blue screen errors (BSOD) due to system hardware, BIOS settings, and especially Windows updates.
This issue can usually be resolved in the following ways:

Virtual Machine (VT-x/SVM) Settings:

Ensure that virtualization technologies such as Intel VT-x (for Intel processors) or AMD SVM (for AMD processors) are enabled in your BIOS. These settings are required for DBVM to function properly.

Hyper-V and Other Virtualization Services:

Windows' own Hyper-V or other virtual machine software such as VMware or VirtualBox can conflict with DBVM. Ensure that Hyper-V and similar virtualization services are disabled in Windows settings.

Operating System Version:

Cheat Engine is known to experience stability issues with newer Windows versions (e.g., some versions of Windows 11). If this issue persists on your current Windows version, you may want to consider using an older, more stable Windows version.

Driver Issues:

DBVM can cause errors when loading kernel drivers.
In this case, it's important to run Cheat Engine as an administrator or ensure your antivirus program isn't blocking this driver.

IPT Mode Limitation (Self-Modifying Code) Solutions:

IPT (Intel Processor Trace) mode is a hardware-based solution used to trace code execution.

However, it may not be able to accurately track self-modifying code, that is, code that modifies its own commands at runtime.

This is particularly useful for some modern anti-cheat systems and makes tracing difficult. Alternative solutions that can be used to overcome this limitation include:

DBVM (Direct-Bypass Virtual Machine):

DBVM mode can overcome this problem by providing deeper debugging capabilities within the virtual machine environment.
Unlike IPT's hardware-based monitoring mechanism, DBVM captures code at the virtual machine level, which can better manage changes to self-modifying code.
Therefore, if DBVM can be run more stably, it is a better alternative to IPT.

VMM-Based Solutions:

The most effective method for capturing self-modifying code is the more advanced Virtual Machine Monitor (VMM)-based approaches.

These technologies can monitor and manipulate any code changes and execution flow at the lowest level by running the operating system in a virtual environment.

Software Debugging:

Traditional software debugging techniques, such as single-stepping the code and setting breakpoints, can also be used.
These methods allow you to precisely control the flow of execution and help you identify when and how the code changes.

Code Injection:

Once you identify the point at which the problematic code was changed, you can disable the original code or modify its behavior by injecting your own code.

This is a more indirect but effective way to directly address the problem.

[lcineyes]

1.System: Windows 10

2.dbk64.sys loaded normally

3.DBVM loaded normally

4.Most functions using DBVM are working properly

5.Hyper-V has been disabled. Hyper-V prohibits nested virtualization; if not disabled, DBVM loading cannot be completed.

6.For the Direct-Bypass Virtual Machine approach, which code and corresponding functionality is involved? Is it ultimap1 or ultimap2? I've read a lot of CE's code but haven't found any DBVM-level self-modifying code traces.