Cheat Engine

tima32 · How do I cheat? Reputation: 0 Joined: 04 Aug 2021 Posts: 3

How does the VEH debugger work?
I am interested in implementation and technology.

atom0s · Posted: Thu Aug 05, 2021 12:29 am Post subject:

Cheat Engine is open source, you can find it here:
https://github.com/cheat-engine/cheat-engine

And for the VEH debugger:
https://github.com/cheat-engine/cheat-engine/tree/master/Cheat%20Engine/VEHDebug

https://github.com/cheat-engine/cheat-engine/blob/master/Cheat%20Engine/VEHDebugger.pas

STN · Posted: Thu Aug 05, 2021 5:07 am Post subject: Re: VEH Debuger

tima32 · How do I cheat? Reputation: 0 Joined: 04 Aug 2021 Posts: 3

Thanks for answers! Is there a way to handle / intercept the int 21h and syscall of another process on my own?

Dark Byte · Posted: Thu Aug 05, 2021 11:09 am Post subject:

intercepting software interrupts/syscall? In that case I recommend you to look at the DBVM sourcecode

tima32 · How do I cheat? Reputation: 0 Joined: 04 Aug 2021 Posts: 3

What are the differences between AddVectoredExceptionHandler and AddVectoredContinueHandler?

atom0s · Posted: Tue Aug 10, 2021 2:10 am Post subject:

See here:
https://reverseengineering.stackexchange.com/a/14993

MSDN's info is very lacking on what the differences are or what a continued handler is even for, but this post digs into the guts under the hood to find the differences etc.

Ph3r0X

Hi guys,
I know I'm a bit late to the party, but better sooner than ever Very Happy

Been working with the Windows Instrumentation Callback for a while now, when I showed a friend of mine some concepts that I used it for he asked, why not to use it for debugging purposes.
His question reminded me of the VEH-debugger, as the concept seems pretty similar: As far as I understand, the VEH debugger works by setting a Vectored Exception Handler, that is called when the kernel returns to usermode and calls KiExceptionDispatcher (caused by hardware breakpoints for example).
After testing and confirming, that the instrumentation callback catches every type of interrupt after returning to usermode (this includes exceptions), I figured that you could indeed use this concept to achieve the same behaviour as the VEH-Handler...
So why even do this? If the game knows about VEH-debugging it could simply add its own VE-Handler on top, potentially skipping the CE-VEH. However, the Instrumentation Callback is directly invoked before the kernel dispatches to the usermode handler, which means way before any VEH can intercept the "debugger".
I hope I am not misunderstanding anything here and that this ain't a duplicate. Of course you can also just use the DBVM debugger, however this method doesn't require going kernel and has additional potential like catching syscalls.

Let me know what you guys think about it...