Cheat Engine

mgostIH · Posted: Sat Jan 09, 2016 11:30 am Post subject: Question about Remote Threads

So, I was testing new ways for developing hacks that runs without having an external process opened.
I thought about creating remote threads on some allocated memory in which an asm script would do all the "magic".

I have no problem at coding asm x86 or using windows APIs, but I have no clue on how to stop a thread safely without stopping it externally.
Debugging it with Cheat Engine breakpoints would always lead to a crash, and using ret and the end of the script was doing a fine job of "closing" the thread.

I wondered about how this was happening, so I programmed a little script for testing it out and I saw the ret was going to start this procedure:

Dark Byte · Posted: Sat Jan 09, 2016 12:12 pm Post subject:

this happens with CreateRemoteThread()

You just have to make sure that your stack pointer (ESP/RSP ) is exactly the same as when the thread started when ret is called (and the return address hasn't been tampered with)

mgostIH · Posted: Sat Jan 09, 2016 1:12 pm Post subject:

Dark Byte · Posted: Sat Jan 09, 2016 4:09 pm Post subject:

yes. use the windows debugger as that is the only one that can set a breakpoint on newly created threads

then just set a breakpoint and create the thread