Hi, I usally dump wow with x64dbg with scylla and Overwatchdumpfix but with the latest versions of wow executing overwatchfix command gives in x64dbg log:
[OverwatchDumpFix] Deobfuscating the import address table...
[OverwatchDumpFix] Found the remote IAT: 00007FF696703000
[OverwatchDumpFix] ReadProcessMemory failed: 299. (Address = 00007FF696703000, Size = 0x2EE0)
[OverwatchDumpFix] Error: failed to enumerate IAT entries.
[OverwatchDumpFix] Error: failed to rebuild imports
I also get error before that, that it cant read wow_loader.dll. Im not sure if that is causing the error above as a result:
DLL Loaded: 00007FF90AC30000 C:\Windows\System32\CoreMessaging.dll
DLL Loaded: 00007FF86EA70000 C:\Windows\System32\Speech\Common\sapi.dll
DLL Loaded: 00007FF906D50000 C:\Windows\System32\CoreUIComponents.dll
EXCEPTION_DEBUG_INFO:
dwFirstChance: 1
ExceptionCode: C0000005 (EXCEPTION_ACCESS_VIOLATION)
ExceptionFlags: 00000000
ExceptionAddress: 0000014E12BDE016
NumberParameters: 2
ExceptionInformation[00]: 0000000000000008 DEP Violation
ExceptionInformation[01]: 0000014E12BDE016 Inaccessible Address
First chance exception on 0000014E12BDE016 (C0000005, EXCEPTION_ACCESS_VIOLATION)!
Error replacing page: 00007FF821210000[0000000000010000] (wow_loader.dll)
Sections:
".text": 00007FF820DD0000[0000000000363000]
".rdata": 00007FF821140000[000000000006B000]
".data": 00007FF8211B0000[0000000000004000]
".pdata": 00007FF8211C0000[0000000000005000]
".gxfg": 00007FF8211D0000[0000000000002000]
".tls": 00007FF8211E0000[0000000000001000]
"_RDATA": 00007FF8211F0000[0000000000001000]
".rsrc": 00007FF821200000[0000000000001000]
".reloc": 00007FF821210000[0000000000001000]
".eid": 00007FF821220000[0000000000450000]
New pages:
" ".reloc"": 00007FF821210000[0000000000001000]
Please report an issue!
Error replacing page: 00007FF821200000[0000000000010000] (wow_loader.dll)
Sections:
".text": 00007FF820DD0000[0000000000363000]
".rdata": 00007FF821140000[000000000006B000]
".data": 00007FF8211B0000[0000000000004000]
".pdata": 00007FF8211C0000[0000000000005000]
".gxfg": 00007FF8211D0000[0000000000002000]
".tls": 00007FF8211E0000[0000000000001000]
"_RDATA": 00007FF8211F0000[0000000000001000]
".rsrc": 00007FF821200000[0000000000001000]
".reloc": 00007FF821210000[0000000000001000]
".eid": 00007FF821220000[0000000000450000]