Cheat Engine

[reverser69]

hi

i encountered a problem and I'm not sure if its a bug.
i pause the process using the button in "advanced options". then unpause and then i try to attach to that process using windows debugger.
by doing so, cheat engine shows "attach time out" infinitely.
i tried using "NtSuspendThread" and getting the same result.

[Dark Byte]

I can't reproduce it.

Perhaps it's a config on your system or something. Try pressing the print screen button on your keyboard. Does the whole system freeze for a minute ?

[reverser69]

tried and no freezing.


btw, is "CEP_PAUSE pause" is CE sdk the same as pausein advanced options?
maby using it will fix everything.


edit:
i guess i found it.
does CE check "peb->isbeingdebuged" to determine if the debugger successfully attached to the target?

i am trying to write a plugin. in it, i am using debugEvent callback to reset peb->isbeingdebuged flag. i think it creates an infinite loop.

[Dark Byte]

CE doesn't but windows does

it won't send any debug events to CE when peb->isBeingDebugged is false

[reverser69]

thanks for the confirmation.

i have another idea of using exported "pause" function.
is there any way of finding out if a process is already paused? if so call unpause?

edit:
i tried calling "unpause" exported function on an already un-touched process and everything seems good. is it a safe practice?

[Dark Byte]

try experimenting with ntSuspendThread followed by ntResumeThread on the main thread.

if it returns 1+ it was frozen

[reverser69]

well my idea was to suspend the app and resume it at other debug events to let the window debugger initialize.
when debugging in VS, this works. but when i execute the plugin normally, suspension interferes with debug events workflow. i think i cant do it this way.


another idea is to start patching peb at "EXIT_THREAD_DEBUG_EVENT" event.
with the theory of CE's 'Debugger thread' thread has done everything necessary and terminates before target application gets a chance to execute any code. am i correct?


is there any way (lua or c++) that i could use to determine if the debugger is done attaching and then start my patch?

[Dark Byte]

the plugin system does support hooking into the waitfordebugevent function , you could watch that for what you need