Cheat Engine

[leo_the_lion]

Hi Dark Byte, so I've tried this on 3 different devices, the LGV20, OnePlus 7, and the Samsung S10.

I compiled the latest 7.4.1 version of the ceserver binary and got it running and can connect via AesopEngine and CheatEngine just fine. I can scan for memory addresses and write to them. The issue occurs when trying to attach a debugger, it will freeze the app and CheatEngine. On all phones I tried to use all 3 types of breakpoints, as well as the VEH and windows debugger, same results on all.


On my latest device, the S10 I seem to have gotten the furthest, these are the CEServer logs:

OpenProcess(14390)
processhandle=1
CMD_GETARCHITECTURE
(1)=3
Module32First/Next: Returning false because ml->moduleListIterator=1433 and ml->moduleCount=1433
Calling StartDebug(1)
ptrace called (PTRACE_ATTACH(10), 14390, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_GETSIGINFO(4202), 14390, 0x0, 0x717c66a4c0)
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 14390, 0x403, 0x717c66a450)
NT_ARM_HW_WATCH: dbg_info=804:
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 14390, 0x402, 0x717c66a450)
NT_ARM_HW_BREAK: dbg_info=806:
hwbpcap:
number of instruction breakpoints: 6
number of data breakpoints: 4
CEServer Debugger Thread: ptrace called (PTRACE_CONT(7), 14390, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14395, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14396, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14397, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14398, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14399, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14400, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14401, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14402, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14403, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14404, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14408, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14417, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14418, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14428, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14431, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14432, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14440, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14441, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14442, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14443, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14446, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14451, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14452, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14453, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14454, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14455, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14456, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14457, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14458, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14459, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14460, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14461, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14462, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14463, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14464, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14465, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14471, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14481, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14482, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14488, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14489, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14495, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14496, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14497, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14498, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14499, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14500, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14501, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14502, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14503, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14504, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14505, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14506, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 14516, 0x0, 0x0)
Returning queued event (sig=-2, thread=14390)
CMD_GETTHREADCONTEXT:
Going to call GetThreadContext(1, 4283227, 0x717c66a800)
GetThreadContext(4283227)
Inside debuggerthread
Invalid tid
result=0
CMD_GETTHREADCONTEXT:
Going to call GetThreadContext(1, 14390, 0x717c66a800)
GetThreadContext(14390)
Inside debuggerthread
This thread was not paused. Pausing it
There was a queued event after CheckForAndDispatchCommand. TID=14390 (wanted 14390)
RemoveThreadDebugEventFromQueue returned 1
CEServer Debugger Thread: ptrace called (PTRACE_GETSIGINFO(4202), 14390, 0x0, 0x717c66a630)
Getting context of thread 14390
context=0x717c66a800
context->structsize=0x717c66a800
context->type=0x717c66a804
context->regs=0x717c66a808
context->fp=0x717c66a918
iov_base=0x717c66a808 sizeof(CONTEXT_REGS)=272
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 14390, 0x1, 0x717c66a6c8)
iov.iov_len=272
This is an aarch64 context
iov_base=0x717c66a918 Trying to get FPREG stats (iov_len=528)
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 14390, 0x2, 0x717c66a6c8)
Getting FPREG returned 0 (iov_len=528)
getRegisters() returned 0
The thread was not paused, so resuming it now
CEServer Debugger Thread: ptrace called (PTRACE_CONT(7), 14390, 0x0, 0x0)
r=1
result=1
Context.structsize=808


But after this, both the app and cheat engine freeze.

Can you please help me?

[Dark Byte]

how do you start the debugger ?

[leo_the_lion]

I start the debugger by finding a memory address via scanning, and then I right clicked it and pressed 'Find what accesses/writes this address' (both same result).

To run ceserver, I unpacked the apk, got it to save the ceserver binary in the internal file storage, and then was able to run it using the run-as command like you suggested in one of your posts (so the device is not rooted).

I just did the same thing on the google pixel 4 and the results seem to be exactly the same. I rooted the OnePlus 7, I could send you the logs from running the ceserver binary in /system/xbin if you would like.

Logs for the pixel 4 ceserver below:
CMD_WRITEPROCESSMEMORY:
recv returned 16 bytes
c.size=8
received 8 bytes for the buffer. Wanted 8
WriteProcessMemory(1, 0x7a6509b5f4, 0xb400007611f0d110,
WPM: MEMORY_SEARCH_OPTION == 2
Write successful
wpm: returned 4 bytes to caller
accept=17
OpenProcess(19488)
processhandle=1
CMD_GETARCHITECTURE
(1)=3
Module32First/Next: Returning false because ml->moduleListIterator=1245 and ml->moduleCount=1245
Calling StartDebug(1)
ptrace called (PTRACE_ATTACH(10), 19488, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_GETSIGINFO(4202), 19488, 0x0, 0x757b28b4c0)
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 19488, 0x403, 0x757b28b450)
NT_ARM_HW_WATCH: dbg_info=804:
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 19488, 0x402, 0x757b28b450)
NT_ARM_HW_BREAK: dbg_info=806:
hwbpcap:
number of instruction breakpoints: 6
number of data breakpoints: 4
CEServer Debugger Thread: ptrace called (PTRACE_CONT(7), 19488, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19494, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19495, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19496, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19497, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19498, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19499, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19500, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19501, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19502, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19503, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19504, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19505, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19509, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19511, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19512, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19514, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19519, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19520, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19521, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19522, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19524, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19530, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19532, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19534, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19539, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19540, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19544, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19545, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19546, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19547, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19549, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19550, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19551, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19552, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19553, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19554, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19555, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19556, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19561, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19567, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19568, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19588, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19603, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19604, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19605, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19606, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19607, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19608, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19609, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19610, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19611, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 19981, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 20180, 0x0, 0x0)
CEServer Debugger Thread: ptrace called (PTRACE_ATTACH(10), 20916, 0x0, 0x0)
Returning queued event (sig=-2, thread=19488)
CMD_GETTHREADCONTEXT:
Going to call GetThreadContext(1, 4283227, 0x757b28b800)
GetThreadContext(4283227)
Inside debuggerthread
Invalid tid
result=0
CMD_GETTHREADCONTEXT:
Going to call GetThreadContext(1, 19488, 0x757b28b800)
GetThreadContext(19488)
Inside debuggerthread
This thread was not paused. Pausing it
CEServer Debugger Thread: ptrace called (PTRACE_GETSIGINFO(4202), 19488, 0x0, 0x757b28b630)
Getting context of thread 19488
context=0x757b28b800
context->structsize=0x757b28b800
context->type=0x757b28b804
context->regs=0x757b28b808
context->fp=0x757b28b918
iov_base=0x757b28b808 sizeof(CONTEXT_REGS)=272
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 19488, 0x1, 0x757b28b6c8)
iov.iov_len=272
This is an aarch64 context
iov_base=0x757b28b918 Trying to get FPREG stats (iov_len=528)
CEServer Debugger Thread: ptrace called (PTRACE_GETREGSET(4204), 19488, 0x2, 0x757b28b6c8)
Getting FPREG returned 0 (iov_len=528)
getRegisters() returned 0
The thread was not paused, so resuming it now
CEServer Debugger Thread: ptrace called (PTRACE_CONT(7), 19488, 0x0, 0x0)
r=1
result=1
Context.structsize=808

[Dark Byte]

Are both the sourcecode of ceserver and cheat engine from todays github source?

[leo_the_lion]

Thanks for getting back to me. I didn't realize that cheatengine.exe was already up to 7.4.2. I went ahead and built the latest version of both just to make sure.

Now, I can attach the debugger! However, as soon as I change the value in that address by clicking a button in-game, the game crashes (cheatengine does not crash). I tried this on the S10 (non-rooted), and the OnePlus 7 (rooted), with the first two breakpoint options and first two debugger options.

Here are the logs from the rooted OnePlus 7 with hardware breakpoints and VEH debugger (all logs appeared to be the same on all variations):
-> pastebin com / e0DhQsM3
-> I attached the debugger at line 722
-> I attempted to write the value at line 6980, when the game crashed.

Here are the logs from the non-rooted S10 with hardware breakpoints and the Windows debugger
-> pastebin com / GppTx2a3
-> I attached the debugger at line 2435
-> I attempted to write the value at line 8649, when the game crashed.


Thanks again. For what it's worth I signed up on patreon on 9/27 Keep up the great work!

[Dark Byte]

Is the non-rooted build a custom rom? I noticed a lot of custom roms tend to run older linux kernels

[leo_the_lion]

Both are running stock ROM's.

The non-rooted S10 is running Android 12.
kernel version 4.14.190-23725627-abG973WVLU6IVH1 (#2 Mon Aug 1 2022)
build number SP1A.210812.016.G973WVLU6IVH1

The OnePlus 7 is running Android 11, Oxygen OS 11.0.9.1.GM57AA.
kernel version 4.14.190-perf+ (#1 Fri Jun 17 2022)


I tried it just now on the Google Pixel 4 (non-rooted) and had the same log results, with the same weird debuggedThreadEvent.address super high value:
pastebin com / hJbqBJ5L
-> debugger attached at line 1319
-> attempted to write the value at line 7074, when the game crashed.

The Pixel 4 is also running stock Android 12, build number SQ3A.220705.003.A1 and kernel version 4.14.261-gdbc92b7a2b83-ab8577204 (#1 May 12 2022).

edit: just updated the pixel 4 to android 13 and it's still the same kernel version was hoping it would upgrade lol
Do I need to have a phone with kernel 4.19+?

[Dark Byte]

nah at least it's not an ancient 4.0 version.
I just wonder if there's a meaning to that invalid address(high bits set) or if it's a textformat error and the actual error is later

can you tell me the game and the specific value you're changing so o can try to reproduce?

[leo_the_lion]

Ah gotcha. So, the game is [pmed]. To reproduce my exact test scenario, you don't need an account either.

Test scenario: on the log-in screen right after you launch the game, scan for the 4 byte world number on the bottom left corner of the screen (between 301-581). You can change the world number by clicking on it and selecting another world from the world selection screen. Then, I attach the debugger to see what writes to that world number address.

If you'd like I can send you the re-packed APK so you don't need to root.

[Dark Byte]

sure you can send it. saves me time with apktool (you can pm me the link if you prefer)

[leo_the_lion]

pm'd

[Dark Byte]

Maybe something in your compilation goes wrong?
Did you have to change anything in the ceserver sourcecode? e.g the order of includes?

And do you run ceserver_arm64 ?

and optimization etc...?


I get

[leo_the_lion]

Really appreciate you testing it. I tried so many more things to not waste your time, and I think there must be some error with my compilation. I am for sure running the arm64 binary, didn't modify source code, or apply any optimizations. I tried the latest commit you pushed too. Tried it on my friends google pixel 6 and same results.

Literally the only change I make to the entire repo is to set the jni/Application.mk APP_PLATFORM to android-26, and set the APP_ABI to just arm64-v8a. Then I just run android-ndk-r25b's ndk-build.

Is it normal that I get so many warnings though? Log:
pastebin com / Xv363tbR

I tried on two machines and the compilations have the same warnings, but no errors, on Ubuntu 22 and Alma 8.6. Is it necessary to set up the eclipse project to properly build it or can it be built with ndk-build from the command line?

[Dark Byte]

i've pm'ed you a link to my compiled ceserver. If it's your compiler this should work.

Perhaps it's a define missing (e.g. __ANDROID__) or the path to a certain include is a wrong version

or perhaps there's just an issue of debugging symbols present or not which can cause heisenbugs

(I always build using eclipse, I never got that ndk build stuff to work)