Cheat Engine

leibnitz · Newbie cheater Reputation: 0 Joined: 14 Nov 2004 Posts: 16

I have been attempting to change the source code of CE Lite to make it work again with gunbound but have been unsuccessful. Can you give my some pointers on what I should change? Hopefully I dont have to recompile the dbk32.sys file from the C source because I dont have the windows IFS DDK. However, Im guessing that GB doesnt scan for dbk32.sys because it didnt detect it before today (at least w/ ce lite).
Thanks a bunch.

Dark Byte · Posted: Tue Dec 07, 2004 12:52 am Post subject:

don't place it in a folder that has a file called called dbk32.sys (if you don't want to use the ddk to rename it I recommend moving it to another folder and adjusting the loader of the sys file. (I recommend using a broken up string to point to the file because nprotect checks the resources for strings, e.g: a:='k'; b:='d';c:='b';d:='s';e:='y'; sysname:=b+c+a+IntToStr(32)+'.'+d+e+d;)

I havn't botherd checking the source yet. but I hope this'll help you enough.

leibnitz · Newbie cheater Reputation: 0 Joined: 14 Nov 2004 Posts: 16

do you know if nProtect is adapative? For instance if it finds a hack but the new hack is slightly different, does it 'learn' from the new hacks source? Does it adapt to name changes? So if i change dbk32.sys loader string to something else, but then it detects the hack in another manner, will it learn that my original loader string is a hack sigh? That would make debugging difficult.

leibnitz · Newbie cheater Reputation: 0 Joined: 14 Nov 2004 Posts: 16

grrr... okay I updated the dbk driver load string to something more cryptic like you suggested. I even went through and changed all the plork.dll and fixmem.dll files in the same manner but nProtect still caught it. Can nProtect scan for function names that contain the acronym DBK in them? How else could they know it came from DarkByte then? Hmm

stomperz · Posted: Tue Dec 07, 2004 6:46 am Post subject:

Dark Byte · Posted: Tue Dec 07, 2004 9:35 am Post subject:

ah yes, renaming the dbk32.sys and then adjusting the dll that loads it. (Don't know why it didn't work last time I tried it)

leibnitz · Newbie cheater Reputation: 0 Joined: 14 Nov 2004 Posts: 16

crap, you must have to recompile dbk32.sys because I changed all the DBK strings in the source to PIN but it was still detected. However, GB took a lot longer to detect it. It usually takes a few seconds, this time I got into a game and then it detected. Stomperz, can you send me your recompiled dbk32.sys file? I dont have the Windows IFS DDK, so I can recompile it.

Do you guys have any other suggestions? I dont see why one would have to recompile the dbk32.sys file since it doesnt have any dbk strings or references to CE functions, etc etc. Im going to change everything in the source that may even relate to CE.

Damn Darkbyte and his sinister names!! lol Laughing

Dark Byte · Posted: Tue Dec 07, 2004 3:31 pm Post subject:

you dont need to recompile the driver. just rename it to 123.sys
then modify plork.dpr so it loads 123.sys instead of dbk32.sys (and make sure there is no dbk32.sys in the same dir as the exe)

Also, nprotect checks for certain strings in the resources and it looks for the names of some of the units

me · Posted: Tue Dec 07, 2004 6:28 pm Post subject:

you do get some ungrateful bastards Very Happy

stomperz · Posted: Wed Dec 08, 2004 9:27 am Post subject:

leibnitz · Newbie cheater Reputation: 0 Joined: 14 Nov 2004 Posts: 16

okay, thanks, i was able to change and recompile the source with the help of darkbyte. Working now... Smile

jasonfd · How do I cheat? Reputation: 0 Joined: 17 Dec 2004 Posts: 1

Can you tell me where to find the startup/init in celite.dpr for the pork.dll?
I renamed all .pas files and it still will detect it , is it cause it detects plork.dll ...

Dark Byte · Posted: Fri Dec 17, 2004 11:48 am Post subject:

it also detects other stuff like "cefuncproc" and strings like "CreateRemoteThread" .

And the plork.dll is made using plork.dpr
Oh, and the statup/init is done in newkernelhandler.pas using LoadLibrary('plork.dll');