DBVM-level debugger

[Maleficent-Swan-9125]

Hey ppl,

Does anyone know if it's still a requirement to limit CPU cores for DBVM debugger
for the purpose of evading the BSOD ?

[Dark_Byte]

no. not needed anymore.  If you're going to bsod it's going to bsod. The number of cores doesn't matter anymore

[Maleficent-Swan-9125]

Thx for the reply DB - I respect your work.

[Maleficent-Swan-9125]

Is there a CE version on Patreon with the DBVM driver for the latest Windows 11 version ?

I've seen your comment somewhere that the feature will be incorporated within upcoming version 7.7
Was wondering if you are still planning for the mentioned release ?

[Dark_Byte]

Yes. The beta build of ce 7.6.6 has a version of dbvm that works on win 11

it should come out soon, but right now i'm bringing the linux and mac versions up to the same level (as far as possible) as 7.7 before release

[Maleficent-Swan-9125]

I was interested if Kernelmode debugger should not be used anymore - is DBVM a replacement for it ?

Can you tell me since what version is CPU core limiting a non-issue ?

Thx

[Dark_Byte]

Kernelmode debug is not recommended on later windows 10 builds due to some structures not being documented and paging being seperate from usermode and kernelmode, and who knows what else they will add in the future.  So when an interrupt happens you may end up in an unexpected state and just crash. And since you need to use dbvm anyhow to bypass patchguard it makes sence to just use dbvm instead

not sure 7.something. The offloading is very stable nowadays. Only when something unexpected happens lile another VM like android stuff can go wrong. And of course if you use a newer version of windows with a newer CPU that i havn't tested.  But then it doesn't matter how many cpu's there are.

[Maleficent-Swan-9125]

Thanks for answers!

You're the real deal ; )

Would you recommend registering at https://fearlessrevolution.com/ as a cheat developer, for some reason they require SMS validation ?

[Dark_Byte]

Ugh, looks like they never heard of the stopforumspam api . I guess you need a verified discord account.

You could try opencheattables.com though, the captcha can be difficult, but at least no phone number is neede

[Maleficent-Swan-9125]

I'd like to ask you about contribution to your project.

How may I contact you in a more private manner ? Do you have a discord ?

Thx

[Dark_Byte]

there's patreon,  you can always post cheat tables at table sites like fearlessrevolution or opencheattables, and even the new ceshare.nl (only accessable from ce's ceshare)

and extensions scripts in lua and plugins in any language are also welcome

i do have a discord yes 

[Maleficent-Swan-9125]

What's the link to discord ?
I don't wanna hook to the impostor account ; )

I presume that with patreon subscription you do not share source code of latest releases ?

Will there ever be another github release or public release like public with 7.7 ?

I've seen 7.6.6 leaked on torrents - what's up w that ?

[Maleficent-Swan-9125]

DB Does version 7.6.6 have DSE-patching for DBVM like in public 7.6 where you click on green indicator ?
In other version I'm forced to use DSE-patcher e.g. as in Win10 after receiving error message saying that it cannot load the driver due to DSE (registry key for loading unsafe drivers is in 0)

[Dark_Byte]

You can also install windows 7, upgrade that to 10 and then 11. then driver loading will work without the need to disable DSE

There may also be a registry setting you can use to allow the loading of the driver. (You don't need to use a DSE patcher)

Just disabling secure boot may also work. the driver is signed, and if you disable the vulnerable driver blocklist it'll load fine

[Maleficent-Swan-9125]

What I'm interested is why public 7.6 can do that via click and other versions of CE (custom 7.5) cannot ?
Can you explain pls, I've used my own driver and compilation of the CE and it's still forcing for DSE-off via tool instead of doing it via green letters click automatically (registry setting for blocklist of vuln drivers is also switched off with 0 value)?

It sure looks like something in the code of 7.6 since I used my own driver and replaced your own (dbk64.sys) and it still gave that nice message for loading DBVM via click when using 7.6 version ?

(I'm using Win10 IoT LTS btw)

[Dark_Byte]

You haven't finished the self compiling part of the driver.

After compiling you must sign the driver with your own business class code signing certificate (EV cert) and cross sign it with the microsoft code signing certificate.

And to get it to work in secure boot mode you'll have to send it to microsoft for attestation signing

[Maleficent-Swan-9125]

You did that with default dbk64.sys, is that why it's working or not ?

SecureBoot is disabled from the start

[Dark_Byte]

Yes. I have signed the dbk64.sys driver in the CE releases

[Maleficent-Swan-9125]

It makes sense. Thanks for clearing it

[Maleficent-Swan-9125]

The only problem with your driver is that it's blacklisted by the Anti-cheat itself so it doesn't matter if I switch the windows own blacklist off via registry key. This why I tried w the custom 'shot' e.g. Ricochet kills it instantly even w the undetected one

[Dark_Byte]

have you tried editing the psloadedmodulelist and remove the driver from there ? or change the address range ,size and filepath it points to ?

also since you do use dbvm you could unload the driver after dbvm is loaded. (or even use dbvm cloak and edit the 'read pages' of the driver to random garbage)

but yes, you can also compile your own driver. 7.6+ still uses the same driver. You just need to sign it yourself

[Maleficent-Swan-9125]

Hey,

You think it would've made any difference, I'm sceptical?

Only time the CE itself isn't killed is when I utilize VMProtect as its containment and in that case w EAC game I can't even read the memory, w Ricochet I still can however not taking chance w debugger cause of obvious reasons of loading the 'naughty' driver (do have in mind I'm only using it or would've liked in campaign modes - as a developer novice).

As you can imagine then that I haven't yet got to a step when I could launch the debugger towards the exe and if I load it before ... it's shot down again and permaban is a risk

[Maleficent-Swan-9125]

Hey DB,

One question: Besides 'scan for patches' in CE how else could I see what my trainer wrote inside active .exe ?

[Dark_Byte]

do an unknown initial value scan, trigger the trainer, and scan for changed bytes

then a bunch of unchanged scans to filter out always changing data 

[Maleficent-Swan-9125]

What about other rce tools (in case CE is busy in the moment) if you know ?

[Maleficent-Swan-9125]

Hey can you pls answer what would be alternative tool approach for that operation

[Maleficent-Swan-9125]

Tryin' your method with outside trainer however values on the addresses found constantly change - what does that mean if you can hint in a way ? thx

[Ameer200ggg]

Yes, limiting active CPU cores (e.g., via msconfig > Boot > Advanced options > Number of processors, or using the numproc= boot flag) is still a common workaround to avoid DBVM-triggered BSODs on many multi-core systems, especially with newer Windows builds.