Cheat Engine

ta_trainer · Last edited by ta_trainer on Tue Feb 03, 2009 4:32 pm; edited 2 times in total

I am trying to hack a game that keeps on crashing when I modify a single bit in the code.
I thought it must be CRC check and I was correct

BUT, it was xlive.dll that was doing it

do you have any idea how to crack the CRC check for this one?
it must have been used in many other games like Halo...etc
so someone must have done something about it... right?

Dark Byte · Posted: Mon Feb 02, 2009 9:19 am Post subject:

Try finding the routine that reads the game's content. Then make a copy of the game while it's running, and change the crc routine to read the copy instead of the actual memory (aa script commands alloc and loadbinary are useful for this)

and alternatively you could do codecaves (up to 4) using the "Change register at breakpoint" routine and redirect eip to your codecave.

Note, if debugging is being interfered, use kernelmode debugging (and make sure to NOT attach the debugger)

ta_trainer · Posted: Tue Feb 03, 2009 4:28 pm Post subject:

thanks man

is there a way to script these 4 breakpoint instead of doing them manually everytime I run cheatengine ? and then make it as a trainer?

Dark Byte · Posted: Tue Feb 03, 2009 6:40 pm Post subject:

well, it should be possible with the c-script engine in ce . (calling changeregonbp with the proper parameters) but it's currently not supported in a cheat table, or standalone trainer.

You'll then have to code your own trainer in a programming language (you are allowed to use the dbk32 dll and .sys if you require the kernelmode debug routine)

Of course, with 1 debug register you could already make a nice crc bypass.
e.g one at 00401000 , on read of that address change the current pointer to the start of a copied game image. And following that actually editing the whole crc routine out, and perhaps the crc's crc routine as well. (of course, if the crc check is done from a secondary process, then you'll have to find a way to filter it in there, e.g a hook on readprocessmemory )

ta_trainer · Posted: Wed Feb 04, 2009 12:22 am Post subject:

Dark Byte · Posted: Wed Feb 04, 2009 1:14 am Post subject:

there is some talk about it here:
http://forum.cheatengine.org/viewtopic.php?t=299382

I'm sure there are older more detailed topics about this though

Psy · Posted: Mon Aug 17, 2009 2:24 pm Post subject:

http://forum.cheatengine.org/viewtopic.php?t=447505