Adventures in Dead by Daylight (July 18-19th and 21st, 2016) - Part 3

So we're not able to get Cheat Engine loaded (in ring 0) while running Dead by Daylight. What options do we have?

  1. Create 'hello world' device driver that reads first 512 bytes at base address of DBD (POC) - LOE 8 hours
  2. Install DBD in Virtual Box and hook an external debugger into it - LOE unsure. Never done this before. - LOE potentially huge
    • No garuntee this will even work
    • The game could have issues with requirements as Virtual Box graphics emulation isn't meant to play games
    • Debugging a virtual machine could prove to be a huge task on its own
      • Mainly learning the ins and outs of a new debugger
      • Hooking said debugger to external software
      • Won't help when we want to reproduce the learned events easily. Will need to create a piece of software that does what it does without using a virtual machine
  3. Continue searching Google for ways to make Cheat Engine work - LOE not sure
I might be able to think of more options then these three but what I keep coming back to is that I'll eventually need to do option 1. Option 1 will be the foundation for doing this every time the game starts as easily and quickly as possible... fuck it. Let's start!




"Ok, so the concept of drivers in Windows is super straightforward" said literally no one ever. Check out this image from Microsoft

https://msdn.microsoft.com/en-us/windows/hardware/dn913145.aspx

So what am I complaining about? Look at the different types of drivers that they talk about. You have the following new (if you're unfamiliar) acronyms being thrown about:

It looks so freaking confusing. Let's see if we can interpret the hierarchy. I've done this once in the past but let's just use this picture. 

WDK - the Windows 10 driver SDK
WDF - ? windows driver framework
UMDF - user mode drivers - a framework
KMDF - kernel mode drivers - a framework

WDM?? - This wasn't alluded to in the picture, but I've come across it before... Hence, my being anxious to even tackle this topic. So confusing I feel. 

UWP? - Is that an acronym? Anyways, they allude an interface to create drivers for all Windows platforms
More info: https://msdn.microsoft.com/windows/hardware/drivers/develop/getting-started-with-universal-drivers
^ Won't be using this. We need very specific operating system calls to go low-level in zee kernel.

The different between the WDK, WDF, and WDM is soooo unintuitive and confusing. 

This links compares the WDK (specifically the KDMF - maybe this means the WDM is a kernel mode thing only) and WDM
https://msdn.microsoft.com/en-us/windows/hardware/drivers/wdf/differences-between-wdm-and-kmdf

From the above link I found:

WDM - way more low level / very little checks on user input
WDK - framework library that let's devs focus on requirements and the framework's library handles interactions with the OS



OK so that was kind of spastic and all over the place. Let's try to wrap this in a bow:


didn't finish this
WDM (Windows Driver Model)
all drivers are WDMs
didn't finish this
didn't finish this
didn't finish this
didn't finish this

http://stackoverflow.com/questions/16569526/what-is-the-difference-between-a-wdm-driver-a-kmdf-driver-and-a-umdf-driver