Home

Awesome

WoWDumpFix

(Fork of Overwatch-Dump-Fix. Tweaked for WoW)


This x64dbg plugin removes anti-dumping and obfuscation techniques from the popular MMORPG game World of Warcraft. It is meant to be used with Scylla (built into x64dbg) to produce process dump files for static analysis.

This plugin can be used to dump most modern Blizzard games. e.g., It can be used to dump Overwatch.

This project is for educational use only.

Usage

x64dbg Commands

Scylla

Users must enable the Use advanced IAT search setting in the Misc section of Scylla options.

  1. Open Scylla in x64dbg's Plugins menu.
  2. Open the options dialog from the Misc menu.
  3. Enable the 'Use advanced IAT search' setting in the bottom right corner.

x64dbg

  1. Attach x64dbg to Wow.exe then execute the WoWDumpFix command.
  2. Open Scylla in x64dbg's Plugins menu then select Wow.exe in the "Attach to an active process" drop-down list.
  3. Click IAT Autosearch.
  4. A dialog box will inform the user that the IAT search advanced result does not match the normal search result. Click Yes.
  5. Verify that the address of the VA field in the IAT Info region matches the address of the IAT found in the log tab.
  6. Click Get Imports.
  7. Click Dump to create a dump file.
  8. Click Fix Dump and select the dump file from (7) to reconstruct imports.
  9. The Scylla output view should say "Import Rebuild success [FILE PATH]".
  10. Click PE Rebuild and select the fixed dump file.

IDA Pro

  1. Open the dump file in IDA. Check the Manual load and Load resources (optional) boxes. Click OK / Yes for every prompt.
  2. Run the Universal Unpacker Manual Reconstruct plugin for the IAT to set imports to the correct color.
  3. Happy reversing :sunglasses:.

Warning

The WoW process patches the byte at the address of ntdll!DbgBreakPoint from a software breakpoint instruction (0xCC) to a return instruction (0xC3) to prevent debuggers from attaching.

This plugin patches the byte at the address of ntdll!DbgBreakPoint in the virtual address space of the debuggee to '0xCC' if that byte is not '0xCC'. This byte is checked inside every CREATE_PROCESS_DEBUG_EVENT debug event (i.e., whenever x64dbg attaches to a process).

Version History

Release v6 (2019.04.09)

Release v5.1.0 (2019.03.16)

Release v5.0.2 (2018.06.17)

Release v5.0.1 (2017.05.23)

Notes