denuvo-ref/cheat-engine
1
0
Fork 0
mirror of https://github.com/cheat-engine/cheat-engine synced 2026-08-15 02:26:08 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ultimap2 can now also do full system log generation

Browse source
This commit is contained in:
Dark Byte 2019-03-05 16:11:51 +01:00
parent b761030607
commit fb5a39cdd2
10 changed files with 235 additions and 101 deletions
Download patch file Download diff file Expand all files Collapse all files

16
Cheat Engine/dbk32/DBK32functions.pas
View file

@ -362,7 +362,7 @@ procedure ultimap_pause;
procedure ultimap_resume;
procedure ultimap2(processid: dword; size: dword; outputfolder: widestring; ranges: TURangeArray; noPMI: boolean=false);
procedure ultimap2(processid: dword; size: dword; outputfolder: widestring; ranges: TURangeArray; noPMI: boolean=false; logUserMode: boolean=true; logKernelMode: boolean=false);
procedure ultimap2_disable;
function ultimap2_waitForData(timeout: dword; var output: TUltimap2DataEvent): boolean;
procedure ultimap2_continue(cpunr: integer);
@ -507,13 +507,15 @@ begin
end;
procedure ultimap2(processid: dword; size: dword; outputfolder: widestring; ranges: TURangeArray; noPMI: boolean=false);
procedure ultimap2(processid: dword; size: dword; outputfolder: widestring; ranges: TURangeArray; noPMI: boolean=false; logUserMode: boolean=true; logKernelMode: boolean=false);
var
inp:record
PID: UINT32;
BufferSize: UINT32;
rangecount: UINT32;
noPMI: UINT32;
UserMode: UINT32;
KernelMode: UINT32;
range: array[0..7] of TURange;
filename: array [0..199] of WideChar;
end;
@ -554,6 +556,16 @@ begin
else
inp.noPMI:=0;
if logusermode then
inp.UserMode:=1
else
inp.UserMode:=0;
if logkernelmode then
inp.KernelMode:=1
else
inp.KernelMode:=0;
for i:=0 to inp.rangecount-1 do
begin
inp.range[i]:=ranges[i];

107
Cheat Engine/frmUltimap2Unit.lfm
View file

@ -1,11 +1,11 @@
object frmUltimap2: TfrmUltimap2
Left = 407
Height = 573
Height = 688
Top = 165
Width = 739
AutoSize = True
Caption = 'Ultimap 2'
ClientHeight = 573
ClientHeight = 688
ClientWidth = 739
OnClose = FormClose
OnCloseQuery = FormCloseQuery
@ -16,13 +16,13 @@ object frmUltimap2: TfrmUltimap2
LCLVersion = '1.6.4.0'
object Panel5: TPanel
Left = 0
Height = 463
Height = 521
Top = 0
Width = 739
Align = alTop
AutoSize = True
BevelOuter = bvNone
ClientHeight = 463
ClientHeight = 521
ClientWidth = 739
TabOrder = 0
OnClick = Panel5Click
@ -31,7 +31,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideBottom.Side = asrBottom
Left = 0
Height = 15
Top = 448
Top = 506
Width = 6
Anchors = [akLeft, akBottom]
Caption = '0'
@ -249,13 +249,13 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Control = Panel5
AnchorSideRight.Control = Panel4
Left = 0
Height = 463
Height = 521
Top = 0
Width = 323
Anchors = [akTop, akLeft, akRight]
AutoSize = True
BevelOuter = bvNone
ClientHeight = 463
ClientHeight = 521
ClientWidth = 323
Constraints.MinWidth = 100
TabOrder = 1
@ -265,7 +265,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrBottom
Left = 5
Height = 15
Top = 448
Top = 506
Width = 145
Caption = 'Instruction Pointer List Size:'
ParentColor = False
@ -279,7 +279,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideRight.Side = asrBottom
Left = 115
Height = 64
Top = 382
Top = 440
Width = 64
BorderSpacing.Top = 2
BorderSpacing.Bottom = 2
@ -310,7 +310,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideRight.Control = Panel1
Left = 5
Height = 25
Top = 402
Top = 460
Width = 105
AutoSize = True
BorderSpacing.Left = 5
@ -327,7 +327,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideRight.Side = asrBottom
Left = 5
Height = 148
Top = 232
Top = 290
Width = 204
AutoSize = True
Caption = 'Ranges: (Empty for all) (Max 0) '
@ -383,12 +383,12 @@ object frmUltimap2: TfrmUltimap2
end
object rbRuntimeParsing: TRadioButton
AnchorSideLeft.Control = rbLogToFolder
AnchorSideTop.Control = edtBufSize
AnchorSideTop.Control = cbKernelmode
AnchorSideTop.Side = asrBottom
Left = 5
Height = 19
Hint = 'Constantly process the data instead of waiting for the user''s input'
Top = 26
Top = 84
Width = 171
Caption = 'Process data while recording'
OnChange = rbLogToFolderChange
@ -405,7 +405,7 @@ object frmUltimap2: TfrmUltimap2
Left = 21
Height = 23
Hint = 'The folder to store the processor trace files. '#13#10'These files can be quite big (a few seconds can already be over 200MB of space or more)'
Top = 64
Top = 122
Width = 302
Directory = 'd:\lotsofspace'
ShowHidden = False
@ -428,7 +428,7 @@ object frmUltimap2: TfrmUltimap2
Left = 5
Height = 19
Hint = 'CE will write the results to disk as quickly as possible but won''t process it until the recording is stopped, or a filter function is being used.'
Top = 45
Top = 103
Width = 112
Caption = 'Process data later'
Checked = True
@ -443,7 +443,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrCenter
Left = 5
Height = 15
Top = 7
Top = 8
Width = 78
BorderSpacing.Left = 5
Caption = 'Buffer per CPU'
@ -454,10 +454,10 @@ object frmUltimap2: TfrmUltimap2
AnchorSideLeft.Side = asrBottom
Left = 86
Height = 23
Top = 3
Top = 4
Width = 56
BorderSpacing.Left = 3
BorderSpacing.Top = 3
BorderSpacing.Top = 4
TabOrder = 6
Text = '16384'
end
@ -468,7 +468,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrCenter
Left = 145
Height = 15
Top = 7
Top = 8
Width = 14
BorderSpacing.Left = 3
Caption = 'KB'
@ -481,7 +481,7 @@ object frmUltimap2: TfrmUltimap2
Left = 21
Height = 19
Hint = 'Normally Cheat Engine will delete the trace files after they have been processed. But if you wish to save them for your own use, check this box'#13#10#13#10'These trace files can grow really big, so make sure you have enough diskspace'
Top = 171
Top = 229
Width = 137
Caption = 'Don''t delete trace files'
ParentShowHint = False
@ -495,7 +495,7 @@ object frmUltimap2: TfrmUltimap2
Left = 5
Height = 19
Hint = 'When enabled will write the sequence of events as they happen as plain text to a file called cpu#trace.txt.'#13#10'This file contains the disassemble and some event data that happens along the way.'#13#10#13#10'It is recommended to use a very small range, and a stop condition'
Top = 190
Top = 248
Width = 129
Caption = 'Parse trace to textfile'
OnChange = cbParseToTextfileChange
@ -512,7 +512,7 @@ object frmUltimap2: TfrmUltimap2
Left = 21
Height = 23
Hint = 'The folder to store the trace output to'#13#10'It is recommended to use a small region with a stop condition, else this disk will be full before you know it'
Top = 209
Top = 267
Width = 302
Directory = 'd:\lotsofspace'
ShowHidden = False
@ -533,7 +533,7 @@ object frmUltimap2: TfrmUltimap2
Left = 21
Height = 19
Hint = 'When enabled this will check the filesize every few seconds, and will process the files when they have grown beyond the given size.'#13#10#13#10'Note: Due to the way the processing is done, trace data will still be written to disk during the processing. If you generate more data than can be processed at a time, the filesize will keep growing. You can combine this with the "Pause target while processing" option so that it shouldn''t generate too much data'
Top = 87
Top = 145
Width = 136
Caption = 'Autoprocess tracefiles'
ParentShowHint = False
@ -547,7 +547,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrBottom
Left = 159
Height = 23
Top = 129
Top = 187
Width = 48
Enabled = False
OnChange = edtMaxFilesizeChange
@ -561,7 +561,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrCenter
Left = 212
Height = 15
Top = 133
Top = 191
Width = 18
BorderSpacing.Left = 5
Caption = 'MB'
@ -573,7 +573,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrBottom
Left = 21
Height = 19
Top = 152
Top = 210
Width = 176
Caption = 'Pause target while processing'
TabOrder = 12
@ -584,7 +584,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrCenter
Left = 37
Height = 19
Top = 131
Top = 189
Width = 122
Caption = 'when filesize above'
OnChange = cbWhenFilesizeAboveChange
@ -595,7 +595,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Control = edtFlushInterval
Left = 37
Height = 19
Top = 106
Top = 164
Width = 51
BorderSpacing.Left = 16
Caption = 'every '
@ -609,7 +609,7 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrBottom
Left = 88
Height = 23
Top = 106
Top = 164
Width = 42
Enabled = False
OnChange = edtFlushIntervalChange
@ -623,29 +623,66 @@ object frmUltimap2: TfrmUltimap2
AnchorSideTop.Side = asrCenter
Left = 132
Height = 15
Top = 110
Top = 168
Width = 44
BorderSpacing.Left = 2
Caption = 'Seconds'
ParentColor = False
end
object cbTraceAllProcesses: TCheckBox
AnchorSideLeft.Control = Panel6
AnchorSideTop.Control = edtBufSize
AnchorSideTop.Side = asrBottom
Left = 5
Height = 19
Top = 27
Width = 118
BorderSpacing.Left = 5
Caption = 'Trace all processes'
OnChange = cbTraceAllProcessesChange
TabOrder = 16
end
object cbUsermode: TCheckBox
AnchorSideLeft.Control = cbTraceAllProcesses
AnchorSideTop.Control = cbTraceAllProcesses
AnchorSideTop.Side = asrBottom
Left = 5
Height = 19
Top = 46
Width = 74
Caption = 'Usermode'
Checked = True
State = cbChecked
TabOrder = 17
end
object cbKernelmode: TCheckBox
AnchorSideLeft.Control = cbUsermode
AnchorSideTop.Control = cbUsermode
AnchorSideTop.Side = asrBottom
Left = 5
Height = 19
Top = 65
Width = 84
Caption = 'Kernelmode'
TabOrder = 18
end
end
end
object Panel2: TPanel
Left = 0
Height = 110
Top = 463
Height = 167
Top = 521
Width = 739
Align = alClient
AutoSize = True
BevelOuter = bvNone
Caption = 'Panel2'
ClientHeight = 110
ClientHeight = 167
ClientWidth = 739
TabOrder = 1
object ListView1: TListView
Left = 0
Height = 65
Height = 122
Top = 0
Width = 739
Align = alClient
@ -676,7 +713,7 @@ object frmUltimap2: TfrmUltimap2
object Panel3: TPanel
Left = 0
Height = 45
Top = 65
Top = 122
Width = 739
Align = alBottom
AutoSize = True

43
Cheat Engine/frmUltimap2Unit.pas
View file

@ -158,6 +158,9 @@ type
cbAutoProcess: TCheckBox;
cbPauseTargetWhileProcessing: TCheckBox;
cbNoInterrupts: TCheckBox;
cbTraceAllProcesses: TCheckBox;
cbUsermode: TCheckBox;
cbKernelmode: TCheckBox;
deTargetFolder: TDirectoryEdit;
deTextOut: TDirectoryEdit;
edtFlushInterval: TEdit;
@ -206,6 +209,7 @@ type
procedure btnShowResultsClick(Sender: TObject);
procedure cbfilterOutNewEntriesChange(Sender: TObject);
procedure cbParseToTextfileChange(Sender: TObject);
procedure cbTraceAllProcessesChange(Sender: TObject);
procedure cbTraceIntervalChange(Sender: TObject);
procedure cbWhenFilesizeAboveChange(Sender: TObject);
procedure edtFlushIntervalChange(Sender: TObject);
@ -1680,13 +1684,17 @@ begin
end;
if rbLogToFolder.Checked then
ultimap2(processid, bsize, deTargetFolder.Directory, ranges, cbNoInterrupts.checked)
ultimap2(ifthen(cbTraceAllProcesses.checked,0,processid), bsize, deTargetFolder.Directory, ranges, cbNoInterrupts.checked, cbUsermode.checked, cbKernelmode.checked)
else
ultimap2(processid, bsize, '', ranges, cbNoInterrupts.checked);
ultimap2(ifthen(cbTraceAllProcesses.checked,0,processid), bsize, '', ranges, cbNoInterrupts.checked);
end;
FilterGUI(true);
if cbTraceAllProcesses.checked then
FilterGUI(false)
else
FilterGUI(true);
for i:=0 to length(workers)-1 do
workers[i].start;
@ -1705,7 +1713,14 @@ begin
if state=rsRecording then
begin
ultimap2_pause;
FlushResults(foNone);
if cbTraceAllProcesses.checked then
begin
ultimap2_resetTraceSize;
ultimap2_flush;
end
else
FlushResults(foNone);
if rbRuntimeParsing.checked then
@ -2287,6 +2302,26 @@ begin
deTextOut.ButtonOnlyWhenFocused:=false;
end;
procedure TfrmUltimap2.cbTraceAllProcessesChange(Sender: TObject);
begin
if cbTraceAllProcesses.checked then
begin
rbLogToFolder.checked:=true;
rbRuntimeParsing.enabled:=false;
cbAutoProcess.checked:=false;
cbAutoProcess.Enabled:=false;
cbPauseTargetWhileProcessing.enabled:=false;
cbPauseTargetWhileProcessing.checked:=false;
cbDontDeleteTraceFiles.checked:=true;
end
else
begin
rbRuntimeParsing.enabled:=true;
cbAutoProcess.enabled:=true;
end;
end;
procedure TfrmUltimap2.cbTraceIntervalChange(Sender: TObject);
begin
if cbTraceInterval.checked then

22
Cheat Engine/memscan.pas
View file

@ -16,7 +16,8 @@ interface
uses windows, FileUtil, LCLIntf,sysutils, classes,ComCtrls,dialogs, NewKernelHandler,math,
SyncObjs, windows7taskbar,SaveFirstScan, savedscanhandler, autoassembler,
symbolhandler, CEFuncProc,shellapi, customtypehandler,lua,lualib,lauxlib,
LuaHandler, fileaccess, groupscancommandparser, commonTypeDefs, LazUTF8, forms, LazFileUtils;
LuaHandler, fileaccess, groupscancommandparser, commonTypeDefs, LazUTF8,
forms, LazFileUtils, LCLProc;
{$define customtypeimplemented}
{$endif}
@ -5006,7 +5007,7 @@ var i: integer;
x: ptruint;
currentbase: ptruint;
size: dword;
size, _size: dword;
actualread: ptrUint;
memorybuffer: ^byte;
toread: dword;
@ -5078,9 +5079,14 @@ begin
actualread:=0;
//variablesize:=0;
if size<toread then
ReadProcessMemory(phandle,pointer(currentbase),memorybuffer,size+variablesize-1,actualread) //+variablesize for overlap, only when not unknown var
_size:=size+variablesize-1
else
ReadProcessMemory(phandle,pointer(currentbase),memorybuffer,size,actualread);
_size:=size;
ReadProcessMemory(phandle,pointer(currentbase),memorybuffer,_size,actualread);
//sanitize the results
if actualread>_size then actualread:=_size;
if scanOption=soUnknownValue then
begin
@ -5132,6 +5138,7 @@ begin
lastpart:=103;
if (scanOption<>soUnknownValue) then flushroutine; //save results
lastpart:=104;
finally
{$ifdef LOWMEMORYUSAGE}
if previousmemoryfile<>nil then
@ -5143,8 +5150,6 @@ begin
if (scanOption<>soUnknownValue) and (memorybuffer<>nil) then
virtualfree(memorybuffer,0,MEM_RELEASE);
{$endif}
end;
end;
@ -5175,7 +5180,9 @@ begin
end;
//tell scanwriter to stop
lastpart:=2;
scanwriter.flush;
lastpart:=3;
if scanwriter.writeError then
raise exception.Create(Format(rsDiskWriteError, [scanwriter.errorString]));
@ -5187,6 +5194,9 @@ begin
log('Scanner exception:'+errorstring);
DebugLn('Scanner exception:'+errorstring);
DumpExceptionBackTrace;
//tell all siblings to terminate, something messed up
//and I can just do this, since the ScanController is waiting for us, and terminate is pretty much atomic
//for i:=0 to length(OwningScanController.scanners)-1 do

2
DBKKernel/DBKKernel.vcxproj
View file

@ -254,7 +254,7 @@
<Command>cd $(MSBuildProjectDirectory)\$(Inf2CatSource)
copy ..\dbk64.pdb .
makecab /f "$(ProjectDir)\dbk64.ddf"
"c:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool.exe" sign /v /ac "..\..\release\sig\GlobalSign Root CA.crt" /n "Cheat Engine" /t http://timestamp.globalsign.com/scripts/timstamp.dll disk1\dbk64.cab</Command>
"$(DriverSignToolPath)signtool.exe" sign /v /ac "..\..\release\sig\GlobalSign Root CA.crt" /n "Cheat Engine" /t http://timestamp.globalsign.com/scripts/timstamp.dll disk1\dbk64.cab</Command>
</PostBuildEvent>
<PostBuildEvent>
<Message>Generate and sign CAB</Message>

4
DBKKernel/IOPLDispatcher.c
View file

@ -1879,6 +1879,8 @@ NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
UINT32 Size;
UINT32 RangeCount;
UINT32 NoPMI;
UINT32 UserMode;
UINT32 KernelMode;
URANGE Ranges[8];
WCHAR OutputPath[200];
} *inp = Irp->AssociatedIrp.SystemBuffer;
@ -1888,7 +1890,7 @@ NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
for (i = 0; i < (int)(inp->RangeCount); i++)
DbgPrint("%d=%p -> %p", i, (PVOID)(UINT_PTR)inp->Ranges[i].StartAddress, (PVOID)(UINT_PTR)inp->Ranges[i].EndAddress);
SetupUltimap2(inp->PID, inp->Size, inp->OutputPath, inp->RangeCount, inp->Ranges, inp->NoPMI);
SetupUltimap2(inp->PID, inp->Size, inp->OutputPath, inp->RangeCount, inp->Ranges, inp->NoPMI, inp->KernelMode, inp->UserMode);
ntStatus = STATUS_SUCCESS;
break;

125
DBKKernel/ultimap2.c
View file

@ -17,6 +17,9 @@ PSSUSPENDPROCESS PsSuspendProcess;
PSSUSPENDPROCESS PsResumeProcess;
KDPC RTID_DPC;
BOOL LogKernelMode;
BOOL LogUserMode;
PEPROCESS CurrentTarget;
UINT64 CurrentCR3;
HANDLE Ultimap2Handle;
@ -124,10 +127,13 @@ void suspendThread(PVOID StartContext)
KeWaitForSingleObject(&SuspendMutex, Executive, KernelMode, FALSE, NULL);
if (!isSuspended)
{
if (PsSuspendProcess(CurrentTarget) == 0)
isSuspended = TRUE;
else
DbgPrint("Failed to suspend target\n");
if (CurrentTarget == 0)
{
if (PsSuspendProcess(CurrentTarget) == 0)
isSuspended = TRUE;
else
DbgPrint("Failed to suspend target\n");
}
}
KeReleaseMutex(&SuspendMutex, FALSE);
}
@ -712,10 +718,13 @@ NTSTATUS ultimap2_flushBuffers()
DbgPrint("ultimap2_flushBuffers");
KeWaitForSingleObject(&SuspendMutex, Executive, KernelMode, FALSE, NULL);
if (!isSuspended)
if (CurrentTarget)
{
PsSuspendProcess(CurrentTarget);
isSuspended = TRUE;
if (!isSuspended)
{
PsSuspendProcess(CurrentTarget);
isSuspended = TRUE;
}
}
KeReleaseMutex(&SuspendMutex, FALSE);
@ -730,10 +739,13 @@ NTSTATUS ultimap2_flushBuffers()
flushallbuffers = FALSE;
DbgPrint("after wait");
KeWaitForSingleObject(&SuspendMutex, Executive, KernelMode, FALSE, NULL);
if (isSuspended)
if (CurrentTarget)
{
PsResumeProcess(CurrentTarget);
isSuspended = FALSE;
if (isSuspended)
{
PsResumeProcess(CurrentTarget);
isSuspended = FALSE;
}
}
KeReleaseMutex(&SuspendMutex, FALSE);
@ -837,25 +849,38 @@ void ultimap2_setup_dpc(struct _KDPC *Dpc, PVOID DeferredContext, PVOID SystemAr
{
RTIT_CTL ctl;
RTIT_STATUS s;
int i=-1;
int i = -1;
__try
{
{
ctl.Value = __readmsr(IA32_RTIT_CTL);
}
__except (1)
{
DbgPrint("ultimap2_setup_dpc: IA32_RTIT_CTL in unreadable");
return;
}
ctl.Bits.TraceEn = 1;
ctl.Bits.OS = 0;
ctl.Bits.USER = 1;
ctl.Bits.CR3Filter = 1;
if (LogKernelMode)
ctl.Bits.OS = 1;
else
ctl.Bits.OS = 0;
if (LogUserMode)
ctl.Bits.USER = 1;
else
ctl.Bits.USER = 0;
if (CurrentCR3)
ctl.Bits.CR3Filter = 1;
else
ctl.Bits.CR3Filter = 0;
ctl.Bits.ToPA = 1;
ctl.Bits.TSCEn = 0;
ctl.Bits.DisRETC = 0;
@ -1298,7 +1323,7 @@ NTSTATUS ultimap2_resume()
void *clear = NULL;
BOOL RegisteredProfilerInterruptHandler;
void SetupUltimap2(UINT32 PID, UINT32 BufferSize, WCHAR *Path, int rangeCount, PURANGE Ranges, int NoPMI)
void SetupUltimap2(UINT32 PID, UINT32 BufferSize, WCHAR *Path, int rangeCount, PURANGE Ranges, int NoPMI, int UserMode, int KernelMode)
{
//for each cpu setup tracing
//add the PMI interupt
@ -1317,6 +1342,8 @@ void SetupUltimap2(UINT32 PID, UINT32 BufferSize, WCHAR *Path, int rangeCount, P
}
NoPMIMode = NoPMI;
LogKernelMode = KernelMode;
LogUserMode = UserMode;
@ -1356,49 +1383,57 @@ void SetupUltimap2(UINT32 PID, UINT32 BufferSize, WCHAR *Path, int rangeCount, P
//get the EProcess and CR3 for this PID
if (PsLookupProcessByProcessId((PVOID)PID, &CurrentTarget) == STATUS_SUCCESS)
if (PID)
{
//todo add specific windows version checks and hardcode offsets/ or use scans
if (getCR3() & 0xfff)
if (PsLookupProcessByProcessId((PVOID)PID, &CurrentTarget) == STATUS_SUCCESS)
{
DbgPrint("Split kernel/usermode pages\n");
//uses supervisor/usermode pagemaps
CurrentCR3 = *(UINT64 *)((UINT_PTR)CurrentTarget + 0x278);
if ((CurrentCR3 & 0xfffffffffffff000ULL)==0)
//todo add specific windows version checks and hardcode offsets/ or use scans
if (getCR3() & 0xfff)
{
DbgPrint("No usermode CR3\n");
CurrentCR3 = *(UINT64 *)((UINT_PTR)CurrentTarget + 0x28);
}
DbgPrint("Split kernel/usermode pages\n");
//uses supervisor/usermode pagemaps
CurrentCR3 = *(UINT64 *)((UINT_PTR)CurrentTarget + 0x278);
if ((CurrentCR3 & 0xfffffffffffff000ULL) == 0)
{
DbgPrint("No usermode CR3\n");
CurrentCR3 = *(UINT64 *)((UINT_PTR)CurrentTarget + 0x28);
}
DbgPrint("CurrentCR3=%llx\n", CurrentCR3);
DbgPrint("CurrentCR3=%llx\n", CurrentCR3);
}
else
{
KAPC_STATE apc_state;
RtlZeroMemory(&apc_state, sizeof(apc_state));
__try
{
KeStackAttachProcess((PVOID)CurrentTarget, &apc_state);
CurrentCR3 = getCR3();
KeUnstackDetachProcess(&apc_state);
}
__except (1)
{
DbgPrint("Failure getting CR3 for this process");
return;
}
}
}
else
{
KAPC_STATE apc_state;
RtlZeroMemory(&apc_state, sizeof(apc_state));
__try
{
KeStackAttachProcess((PVOID)CurrentTarget, &apc_state);
CurrentCR3 = getCR3();
KeUnstackDetachProcess(&apc_state);
}
__except (1)
{
DbgPrint("Failure getting CR3 for this process");
return;
}
DbgPrint("Failure getting the EProcess for pid %d", PID);
return;
}
}
else
{
DbgPrint("Failure getting the EProcess for pid %d", PID);
return;
CurrentTarget = 0;
CurrentCR3 = 0;
}
if ((PsSuspendProcess == NULL) || (PsResumeProcess == NULL))
{
DbgPrint("No Suspend/Resume support");

2
DBKKernel/ultimap2.h
View file

@ -106,7 +106,7 @@ typedef struct
#pragma pack(pop)
void SetupUltimap2(UINT32 PID, UINT32 BufferSize, WCHAR *Path, int rangeCount, PURANGE Ranges, int NoPMI);
void SetupUltimap2(UINT32 PID, UINT32 BufferSize, WCHAR *Path, int rangeCount, PURANGE Ranges, int NoPMI, int UserMode, int KernelMode);
void DisableUltimap2(void);
NTSTATUS ultimap2_waitForData(ULONG timeout, PULTIMAP2DATAEVENT data);

6
DBKKernel/ultimap2/IOPLDispatcher.c
View file

@ -30,16 +30,18 @@ NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
UINT32 Size;
UINT32 RangeCount;
UINT32 NoPMI;
UINT32 UserMode;
UINT32 KernelMode;
URANGE Ranges[8];
WCHAR OutputPath[200];
} *inp = Irp->AssociatedIrp.SystemBuffer;
int i;
DbgPrint("IOCTL_CE_ULTIMAP2");
DbgPrint("IOCTL_CE_ULTIMAP2 V2");
for (i = 0; i < (int)(inp->RangeCount); i++)
DbgPrint("%d=%p -> %p", i, (PVOID)inp->Ranges[i].StartAddress, (PVOID)inp->Ranges[i].EndAddress);
SetupUltimap2(inp->PID, inp->Size, inp->OutputPath, inp->RangeCount, inp->Ranges, inp->NoPMI);
SetupUltimap2(inp->PID, inp->Size, inp->OutputPath, inp->RangeCount, inp->Ranges, inp->NoPMI, inp->UserMode, inp->KernelMode);
ntStatus = STATUS_SUCCESS;
break;

9
DBKKernel/ultimap2/ultimap2.vcxproj
View file

@ -195,15 +195,16 @@
<TimeStampServer>http://timestamp.globalsign.com/scripts/timstamp.dll</TimeStampServer>
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
<TargetName>ULTIMAP2-64</TargetName>
<OutDir>..\..\Cheat Engine\bin\</OutDir>
<OutDir>..\..\Cheat Engine\bin</OutDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug but signed|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<TimeStampServer>http://timestamp.globalsign.com/scripts/timstamp.dll</TimeStampServer>
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
<EnableInf2cat>false</EnableInf2cat>
<TargetName>ULTIMAP-64</TargetName>
<OutDir>..\Cheat Engine\bin\</OutDir>
<TargetName>ULTIMAP2-64</TargetName>
<OutDir>..\..\Cheat Engine\bin</OutDir>
<PostBuildEventUseInBuild>false</PostBuildEventUseInBuild>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
@ -406,7 +407,7 @@
<Command>cd $(MSBuildProjectDirectory)\$(Inf2CatSource)
copy ..\ultimap2-64.pdb .
makecab /f "$(ProjectDir)\ultimap2-64.ddf"
"c:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool.exe" sign /v /ac "..\..\release\sig\GlobalSign Root CA.crt" /n "Cheat Engine" /t http://timestamp.globalsign.com/scripts/timstamp.dll disk1\ultimap2-64.cab</Command>
"$(DriverSignToolPath)signtool.exe" sign /v /ac "..\..\release\sig\GlobalSign Root CA.crt" /n "Cheat Engine" /t http://timestamp.globalsign.com/scripts/timstamp.dll disk1\ultimap2-64.cab</Command>
</PostBuildEvent>
<PostBuildEvent>
<Message>create cab and sign it</Message>