Cheat Engine

wizboy11

I'm back (after not visiting for months now), and my first game that I choose to adress is RTW:BI 1.6.

Let me get straight to the point. I got the DMA adress that moves around everytime you restart the game. Now I go to see what "acesses that adress" or "writes to that adress" and I get nothing. I change the value and no adresses pop up in the debugger box. I am using the kernal debugger and have to for compatibility issues with RTW (Rome Total War).

I also found something strange when I installed CE. I have no idea if this has to do with my problem, but when I loaded up the kernal debugger, it said it couldn't find a specific offset and is useing the default of 188. Could that be my problem? Havn't tried any other game yet, but I may in a few days.

-DRAGoN.X

(HAPPY NEW YEAR, yea yea, its a little late, but better late then never)

P.S. I'll give you more info if you need it.

Thanks...

UberNoob · Posted: Fri Jan 06, 2006 8:54 pm Post subject:

Anti-hack maybe? If you find any, try to disable it. My lame advice xD

Dark Byte · Posted: Fri Jan 06, 2006 10:36 pm Post subject:

Try it on other games first.
e.g: the tutorial

wizboy11 · Posted: Fri Jan 06, 2006 11:07 pm Post subject:

Well, its works on the tutorial.

Don't know whats going on with RTW then. Guess I should try it again just for the hell of it.

Dark Byte · Posted: Fri Jan 06, 2006 11:43 pm Post subject:

if it uses starforce you won't be able to use it. (easiest method to find out is rightclick the processname, go to the address of the IDT and see if some bytes near there cvhange evry now and then. If they do, it is starforce.)

There is a method arround it, but you'll need to edit the device driver, and then do some code injection in the kernel in starforces own int handler, and redirect it to your own. But you'll have to manually look at what place you do it in (can't do it at the start, or the address the first jump goes to), and make sure you don't screw up the registers

wizboy11 · Posted: Sat Jan 07, 2006 12:11 am Post subject:

Dark Byte · Posted: Sat Jan 07, 2006 5:57 am Post subject:

run cheat engine and open the processwatcher. Then run RTW (that way the kerneldebugger has more knowledge about the threads, and doesn't have to enumerate them again (which goes wrong when that is filtered))

if that also doesn't work:
make sure kernelmode openprocess is enabled
when you do attach to process it should ask you to disable the current debugger , answer yes.
In that mode you can also try exception violations instead of debug registers (e.g if the protection overwrites debug registers you'll need to use those)