Cheat Engine

blahetal · How do I cheat? Reputation: 0 Joined: 07 Feb 2006 Posts: 2

Hi,

when I run a new process via API CreateProcess with flag CREATE_SUSPENDED set, it's not possible to get imported dll's via functions EnumProcessModules nor Module32First/Module32Next. Even ProcessExplorer made by sysinternals cannot reveal imported dll's but cheatengine can.
When I load suspended process into CHE, then click on "Memory view", then in menu select "View Dll's and symbols" and a new window with all imported Dll's appear...how does this feature work? I'm trying this on WinXP.

Libor

Dark Byte · Posted: Tue Feb 07, 2006 5:10 am Post subject:

I use SymEnumerateModules to get all the modules and SymEnumerateSymbols to get all the functions and other symbols of each module.

It's part of the symbol handler of windows (thats why if a game has debug info attached it'll also show that, e.g if you get the windows xp symbol files and use it on minesweeper you'll see that cSec is the name of the timer)