Cheat Engine

mOnSoOn · Posted: Fri Nov 23, 2007 8:10 pm Post subject: DumpRegs

I have an address that stored in ECX register.
I got an address that containts an opcode with the ECX register (with my address..), I want to know how can I dump ECX register.
DumpRegs should help? (RPM\WPM to this address)

appalsap · Posted: Fri Nov 23, 2007 8:19 pm Post subject:

CONTEXT context;

GetThreadContext(TheProcessThread, &context);
//do something with context.ECX

mOnSoOn · Posted: Fri Nov 23, 2007 8:34 pm Post subject:

appalsap · Posted: Fri Nov 23, 2007 8:41 pm Post subject:

TContext (an alias for _CONTEXT) works, are you sure you put Windows in your uses?

mOnSoOn · Posted: Fri Nov 23, 2007 8:43 pm Post subject:

Flyte · Posted: Fri Nov 23, 2007 8:52 pm Post subject:

You have 2 options:

1) Use the TF to step through the code and use GetThreadContext each time to make sure it is at the proper EIP. This method is time consuming (CPU wise).

2) Place an interrupt on the address then catch it as a debugger. When you catch the interrupt use GetThreadContext and replace the overwritten bytes. This method will be detected by a CRC check.

Both will probably be detected since you have to attach as a debugger for both.

mOnSoOn · Posted: Fri Nov 23, 2007 8:55 pm Post subject:

I thought exactly about the 2nd option, but the 1st option.. I have no idea how it works.

(Running in GGless mode)

sphere90 · Posted: Fri Nov 23, 2007 9:10 pm Post subject: