Cheat Engine

reverser69

hi all

cheat engine is really stealthy in kernel mode but we still cant start a process using CE debug modules except for windows debugger (AFAIK) and that is detected easily.
i wanted to debug a game from entry point in CE environment and i couldn't, so decided to port ScyllaHide.

i really appreciate any information on how "break on entry" could be implemented in DBVM debugger.

ScyllaHideCE:
hxxps://github.com/Abbas-MG/ScyllaHide

Dark Byte · Posted: Thu May 30, 2024 2:41 pm Post subject:

you could try the windows debugger to create the process and suspend it, and then use another CE setup DBVM debugging. When done close the CE that had the windows debugger attached. it should release the debugger and subsequent breakpoints should happen on the DBVM debugger

Or you could use CreateProcessA with the CREATE_SUSPENDED process creation flag. One issue is that modules won't show up in CE at that point, but just do a memory scan for 4 byte 0x00905a4d on all memory with a memory alignment of 10000 to find all the loaded modules (the target process and ntdll)