Overwatch Import Deobfuscation Plugin - Downloads - OldSchoolHack

Category: Tools
Developer: qwerty9384
Uploaded by: System
Uploaded at: Mon 14. Nov 2016, 16:18
System: Windows

VirusTotal Result: 0/56

Description

Problems or Questions regarding the hack?
Take a look at our FAQ

This plugin adds the 'oiu' command to x64dbg. executing the command with the IAT's base address will label all obfuscated winapi imports and log the address / label names in the x64dbg log tab. generated labels are automatically deleted once you stop debugging. behavior is undefined if used on any other address or if you run the command more than once per debug session.

Note: The IAT is dynamically built some time between the second TLS callback and the creation of the second thread.

How to use:

1. click on the "Memory Map" tab in x64dbg.
2. find the first region (lowest address) of virtual memory of size 0x3000. it's always near the top of the mem map table.
3. go to this region's base address in the disassembly view.
4. you should see something like this:

TEXT Code:

            00000000000B0000   | 48 | MOVABS  RAX, iphlpapi.7FEF9F73F33  |
            00000000000B000A   | 48 | ADD     RAX, 39F9                  |
            00000000000B0010   | 71 | JNO     B0014                      |

    5. click the base address, press 'ALT+INSERT' to copy the address.
    6. press 'CTRL+ENTER' to focus the cmd line.
    7. type 'oiu ', paste the address, press enter.
    8. check the log for the import name / address dump.
    9. all labels will be automatically removed when you stop debugging.

Download Overwatch Import Deobfuscation Plugin