OWImports v2

Sun 4. Dec 2016, 11:32	OWImports v2	#1
System Join Date: Aug 2007 Posts: 1957	Kategorie: Tools Entwickler: qwerty9384 Beschreibung: his plugin adds the 'oiu' command to x64dbg. the command locates the memory region containing Overwatch's import address table, deobfuscates all import entries, and labels each import's thunk address. how to use: 1. attach x64dbg to overwatch.exe. 2. enter 'oiu' in the command line. example output: [OW Imports]: 00000000002B0A50 actual = 0000000077843380 kernel32.GetCurrentThreadIdStub [OW Imports]: 00000000002B0A66 actual = 00000000778348D0 kernel32.OutputDebugStringAStub [OW Imports]: 00000000002B0A7C actual = 0000000077845190 kernel32.GetCurrentProcessStub [OW Imports]: 00000000002B0A92 actual = 0000000077976540 ntdll.RtlInitializeCriticalSection [OW Imports]: 00000000002B0AA8 actual = 000000007799DA50 ntdll.RtlEnterCriticalSection source code: Only registered and activated users can see links. Download: OWImports v2
System is offline

System

Join Date: Aug 2007

Posts: 1957

Kategorie: Tools
Entwickler: changeofpace

Beschreibung:
Release v3.0

Updated for new protection tech in Overwatch version 1.8.0.2.34978.
Import thunks are now spread across several memory regions. Each thunk has multiple blocks combined with relative jumps.
Now using capstone disassembler to unpack import thunks.
The .rdata view contains 0x1000 bytes of code (not sure if this is new). The plugin will separate this page from .rdata. IDA will automatically combine the two .text sections.

Summary:
This x64dbg plugin removes anti-dumping and obfuscation techniques from Overwatch.exe to make the game able to be dumped using Scylla

How to use:

x64dbg

Attach x64dbg to Overwatch.exe then execute the OverwatchDumpFix command.
Open Scylla in x64dbg's "Plugins" menu then select Overwatch.exe in the "Attach to an active process" drop-down list.
Click "IAT Autosearch".
Click "Get Imports".
Click "Dump" to create a dump file.
Click "Fix Dump" and select the dump file from (5) to reconstruct imports.
The Scylla output view should say "Import Rebuild success [FILE PATH]".
Click "PE Rebuild" and select the fixed dump file.

IDA Pro

Open the dump file in IDA. Check the "Manual load" and "Load resources" (optional) boxes. Click "OK" / "Yes" for every prompt.
Run the "Universal Unpacker Manual Reconstruct" plugin for the IAT to set imports to the correct color.
Happy reversing

Download:
OverwatchDumpFix v3.0

Wed 19. Apr 2017, 12:32		#3
System Join Date: Aug 2007 Posts: 1957	Kategorie: Tools Entwickler: changeofpace Beschreibung: Release v4.0.0 Updated for new protection tech in Overwatch version 1.10.0.2.36031. The 'secret' pe header is no longer stored in memory (or it's now obfuscated). The plugin now uses the pe header from the file on disk as a base when patching Overwatch's invalid pe header. Download: OverwatchDumpFix v4.0.0
System is offline

Sun 30. Apr 2017, 22:07		#4
System Join Date: Aug 2007 Posts: 1957	Kategorie: Tools Entwickler: changeofpace Beschreibung: Release v4.0.1 Updated for new protection tech in Overwatch version 1.10.1.2.36268. The 'secret' pe header is no longer stored in memory (or it's now obfuscated). The plugin now uses the pe header from the file on disk as a base when patching Overwatch's invalid pe header. Plugin now uses WinAPI instead of C++ file streams to get the pe header. This should fix a bug involving unicode paths. Source: Only registered and activated users can see links. Download: OverwatchDumpFix v4.0.1
System is offline

Sat 27. May 2017, 13:38		#5
System Join Date: Aug 2007 Posts: 1957	Kategorie: Tools Entwickler: changeofpace Beschreibung: Release v5.0.0 Updated for Overwatch version 1.11.1.2.36859. The import address table is no longer terminated by two null pointers. The second null has been replaced with a pointer to a 'ret 0' instruction. Download: OverwatchDumpFix v5.0.0
System is offline