Giter VIP home page Giter VIP logo

chamd's Introduction

Chamd (stands for "Chameleon DBK64")

Modified Cheat Engine DBK64 kernel driver

The purpose of this project is to enable usage of Cheat Engine kernel mode driver DBK64.sys on anti-cheat protected system.

It was tested using

It could also work with a lot of other anti-cheats, but it's up to you to figure it out.

Current version is based on Cheat Engine version 7.4

screen It works! Robocraft is EAC protected

0. Disclaimer

Even if you've managed to use this driver successfully it doesn't mean you will not be suspected in cheating. Usage of this software or following instructions from this document and all the consequences of it are totally on you.

Also please note that following these instructions ENDANGERS YOUR SYSTEM TO VULNERABILITIES in one way or the other.

1. Get your driver

You can download the precompiled version here.

This option is perfect for you if you'd like to start fast. However this option is not recommended because there is probability that publicly available driver was already flagged by anti-cheat system. For advanced setup refer to section 7. However it is not necessary at the moment, because zip archive has 1000 drivers. You can pick any.

Copy all 4 files from archive to directory where cheatengine-x86_64.exe is located.

You'll need to use Cheat Engine 7.4.

Then go to section 2.

2. Load the driver

Now you have driver signed with untrusted certificate. You have a few options to load it:

2.1. use EFIGuard to load unsigned drivers (recommended).

2.1.1. Create bootable usb drive for digital signature enforcement bypass.

2.1.1.1. Download and extract archive.

2.1.1.2. Mount you usb drive. 2GB drive is more than enough.

2.1.1.3. Format your usb drive as FAT32. BE CAREFULL TO FORMAT CORRECT DEVICE!!!

2.1.1.4. Partition your device as bootable GPT with EFI partition. BE CAREFULL TO PARTITION CORRECT DEVICE!!!

Open command prompt as administrator.

diskpart
list disk // detect your USB drive
select disk {put number of your USB drive here} // SELECTING CORRECT DISK!!!
list disk // make sure correct disk is selected
clean // wipe out your drive
create partition primary size=512 // create EFI partition
list partitions // created partition shoud be displayed
select partition 1 // select created partition
active // mark partition as active
format quick fs=fat32 // create filesystem
assign // disk should be mounted
exit

2.1.1.5. Copy files to USB drive

Copy EFI directory from archive to the root of your newly created partition.

2.1.1.6. Rename bootloader

Copy and paste EFI\Boot\Loader.efi, than rename it to EFI\Boot\bootx64.efi.

2.1.2. Boot up your system using USB drive.

It is recommended first that you try it on virtual machine such as Virtualbox, HyperV, VMplayer. But if you feel lucky then set up your UEFI to boot from USB drive as first option, second option should be your Windows drive. Also don't forget to disable Secure Boot since EFIGuard is not signed.

Then go to section 3.

2.2. enable test signing (recommended for testing purposes only)

Open command prompt as Administrator

bcdedit /set testsigning on

System needs reboot in order for this command to take effect.

Then go to section 4.

Note:

This option won't work with anticheat, obviously, but is very useful if you just want to test driver loading. Don't forget to disable it when you're done testing.

bcdedit /set testsigning off

2.3. use DSEFix (deprecated)

It should work, but it's not recommended in favor of option 2.1.

Please note that THIS METHOD IS DEPRECATED AND CAN CAUSE OCCASIONAL 'BLUE SCREENS OF DEATH'.

Then go to section 4.

3. Copy files for digital signature enforcement bypass

3.1. Create run.bat in the directory where cheatengine-x86_64.exe located

"%~dp0\EfiDSEFix.exe" -d
start /d "%~dp0" cheatengine-x86_64.exe
timeout /t 20
"%~dp0\EfiDSEFix.exe" -e

3.2. Copy EfiDSEFix.exe to the directory where cheatengine-x86_64.exe located.

Then go to section 4.

4. Configure Cheat Engine

Make sure that

Edit > Settings > Extra > Query memory region routines is checked

Edit > Settings > Extra > Read/Write process memory is checked

Click OK.

It might end up with errors. Close Cheat Engine.

Then go to section 5.

5. Run Cheat Engine after disabling digital signature enforcement.

If you followed section 2.1:

Run run.bat as Administrator .

Do not close popped out window manually!!! Wait for it to close itself.

Once driver was loaded into memory it's enough to run cheatengine-x86_64.exe instead of run.bat.

If you followed section 2.2 or 2.3:

Run cheatengine-x86_64.exe

6. Congratulations

Now you have loaded DBK64 driver signed with untrusted certificate. Kernel mode anticheat will allow to start game and make operations on game memory (last tested on EAC 05/15/2022).

7. [Advanced] Compile the driver from source (recommended)

Anti-cheat systems collect suspicious drivers' signature to block them. One way this could work is when particular driver gets used by few users (of course there's more to anti-cheat systems). To address this issue it's recommended to compile you own version of driver with unique signature.

Note: use PowerShell or Cmder

Video Tutorial

7.1. Clone this repository

git clone https://github.com/dmarov/chamd.git
cd chamd

7.2. Install nodejs. Version 19.1.0 is recommended.

7.3. Install packages

npm install

7.4. Copy .env.tpl to .env

7.5. You may set CHAMD_DBK_DRIVER_NAME in .env to whatever name you wish. Just use your I-M-A-G-I-N-A-T-I-O-N.

7.6. Install Visual Studio (community or enterprise). This project is based on Visual Studio 2019.

7.7. Install MSVC (C/C++ compiler). You can install it by adding the Visual Studio additional package Desktop development with C++.

7.8. Also you'll need to install WDK (Windows Driver Kit) Follow the instructions from the link.

7.9. Install openssl. The least complex way is to use Chocolatey.

choco install openssl

This command needs to be performed as admin

7.10. Run build

npm run all

Note:

You can use EV certificate to sign driver. You could skip digital signature enforcement bypass this way. It's not cheap though and certificate can be revoked.

7.11. Copy all 4 files from 'dist' directory to directory where cheatengine-x86_64.exe is located.

You'll need to use Cheat Engine 7.4.

7.12. If you've managed to compile this driver successfully and want to share few randomized copies then run npm run multibuild 10. dist directory will contain 10 randomized drivers.

Then go to section 3.

chamd's People

Contributors

dmarov avatar tassoneroberto avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.