Cheat Engine

[bitterbanana]

A code cave region I like to use in a game starts at 400300, it has trails of zeros for miles after it. I've been writing to that region with vb6 for a long time. I tried it with c# and I can't write to it anymore.

I know for a fact that it's not a c# problem. I restarted and closed out of my compiler and tried to write a 90 at 400300 with CE's memory viewer, and it quickly changed back to 00. But when I opened vb6 and wrote a 90 to it, I could suddenly write to that region, even when I closed out of vb6.

I'm thinking it has to do with protected memory regions. I guess vb6 overrides something. Any ideas?

[Dark Byte]

Rightclick the address in the hex view and choose "make page wirtable"

Ce already changes the protection quickly when you change the assembler code there.

Also, 400300 is a bad idea for code injection. It's usually not executable (but you'll need to change that anyhow before writing to it)

If the game uses directx 9 just use virtualallocex to allocate a code cave as big as you like, it won't be running on windows me or earlier anyhow.

[bitterbanana]

thanks.

I've been using 400300 for a long time (the memory region list says Execute+Read), and I've had no problems with the apps I've written. Is there anyway I can make the area writiable without using cheat engine?

[Dark Byte]

use virtualprotectex

[bitterbanana]

oh right. Thanks.

[bitterbanana]

I've been trying to get this function to work, but it keeps returning null. Does virtualallocex actually change the page at the address to writable?

VirtualAllocEx(m_hProcess,0x400000,0x1000, MEM_COMMIT |MEM_RESERVED, PAGE_EXECUTE_READWRITE);

That didn't work.

[Dark Byte]

Virtualallocex doesn't change the protection
virtualprotectex does

Virtualallocex allocates a region of memory, and it's usually best to give as base address NULL so windows can specify where to allocate the memory instead of you, and only do mem_commit.

to use virtualprotectex:
VirtualProtectAx(m_hProcess,0x400000,0x1000,PAGE_EXECUTE_READWRITE,NULL);

[bitterbanana]

it worked. thanks again dark byte. you always pull through. I love your work.