This x64dbg plugin removes anti-dumping and obfuscation techniques from the popular FPS game Overwatch. It is meant to be used with Scylla (built into x64dbg) to produce process dump files for static analysis.
This project is for educational use only.
- Updated for new protection tech in Overwatch version 1.10.1.2.36268.
- The 'secret' pe header is no longer stored in memory (or it's now obfuscated). The plugin now uses the pe header from the file on disk as a base when patching Overwatch's invalid pe header.
- Plugin now uses WinAPI instead of C++ file streams to get the pe header. This should fix a bug involving unicode paths.
- OverwatchDumpFix
- Attach x64dbg to Overwatch.exe then execute the OverwatchDumpFix command.
- Open Scylla in x64dbg's Plugins menu then select Overwatch.exe in the "Attach to an active process" drop-down list.
- Click IAT Autosearch -> Get Imports.
- Click Dump to create a dump file.
- Click Fix Dump and select the dump file from (4) to reconstruct imports.
- The Scylla output view should say "Import Rebuild success [FILE PATH]".
- Click PE Rebuild and select the fixed dump file.
- Open the dump file in IDA. Check the Manual load and Load resources (optional) boxes. Click OK / Yes for every prompt.
- Run the Universal Unpacker Manual Reconstruct plugin for the IAT to set imports to the correct color.
- Happy reversing ๐.
A post-build event requires the "X96DBG_PATH" environment variable to be defined to x64dbg's installation directory.
- This plugin is tested while offline on battlenet.