Dumping wow 11.2 issue with wow_loader.dll (Eidolon)

[sunset123]

Hi, I usally dump wow with x64dbg with scylla and Overwatchdumpfix but with the latest versions of wow executing overwatchfix command gives in x64dbg log:

[OverwatchDumpFix] Deobfuscating the import address table...
[OverwatchDumpFix] Found the remote IAT: 00007FF696703000
[OverwatchDumpFix] ReadProcessMemory failed: 299. (Address = 00007FF696703000, Size = 0x2EE0)
[OverwatchDumpFix] Error: failed to enumerate IAT entries.
[OverwatchDumpFix] Error: failed to rebuild imports

I also get error before that, that it cant read wow_loader.dll. Im not sure if that is causing the error above as a result:

DLL Loaded: 00007FF90AC30000 C:\Windows\System32\CoreMessaging.dll
DLL Loaded: 00007FF86EA70000 C:\Windows\System32\Speech\Common\sapi.dll
DLL Loaded: 00007FF906D50000 C:\Windows\System32\CoreUIComponents.dll
EXCEPTION_DEBUG_INFO:
dwFirstChance: 1
ExceptionCode: C0000005 (EXCEPTION_ACCESS_VIOLATION)
ExceptionFlags: 00000000
ExceptionAddress: 0000014E12BDE016
NumberParameters: 2
ExceptionInformation[00]: 0000000000000008 DEP Violation
ExceptionInformation[01]: 0000014E12BDE016 Inaccessible Address
First chance exception on 0000014E12BDE016 (C0000005, EXCEPTION_ACCESS_VIOLATION)!
Error replacing page: 00007FF821210000[0000000000010000] (wow_loader.dll)
Sections:
".text": 00007FF820DD0000[0000000000363000]
".rdata": 00007FF821140000[000000000006B000]
".data": 00007FF8211B0000[0000000000004000]
".pdata": 00007FF8211C0000[0000000000005000]
".gxfg": 00007FF8211D0000[0000000000002000]
".tls": 00007FF8211E0000[0000000000001000]
"_RDATA": 00007FF8211F0000[0000000000001000]
".rsrc": 00007FF821200000[0000000000001000]
".reloc": 00007FF821210000[0000000000001000]
".eid": 00007FF821220000[0000000000450000]
New pages:
" ".reloc"": 00007FF821210000[0000000000001000]
Please report an issue!
Error replacing page: 00007FF821200000[0000000000010000] (wow_loader.dll)
Sections:
".text": 00007FF820DD0000[0000000000363000]
".rdata": 00007FF821140000[000000000006B000]
".data": 00007FF8211B0000[0000000000004000]
".pdata": 00007FF8211C0000[0000000000005000]
".gxfg": 00007FF8211D0000[0000000000002000]
".tls": 00007FF8211E0000[0000000000001000]
"_RDATA": 00007FF8211F0000[0000000000001000]
".rsrc": 00007FF821200000[0000000000001000]
".reloc": 00007FF821210000[0000000000001000]
".eid": 00007FF821220000[0000000000450000]

[Van152]

check your messages

[Saze03]

Sadly got the same problem rn...
(wow_loader.dll is loading properly)

[OverwatchDumpFix] 00007FF65C8C7000 1000 8
[OverwatchDumpFix] 00007FF65C8C8000 E000 4
[OverwatchDumpFix] 00007FF65C8D6000 1F7000 8
[OverwatchDumpFix] 00007FF65CACD000 6000 4
[OverwatchDumpFix] 00007FF65CAD3000 44000 8
[OverwatchDumpFix] 00007FF65CB17000 2000 4
[OverwatchDumpFix] 00007FF65CB19000 1000 8
[OverwatchDumpFix] 00007FF65CB1A000 2A000 4
[OverwatchDumpFix] 00007FF65CB44000 2000 8
[OverwatchDumpFix] 00007FF65CB46000 9000 4
[OverwatchDumpFix] 00007FF65CB4F000 1000 8
[OverwatchDumpFix] 00007FF65CB50000 11000 4
[OverwatchDumpFix] 00007FF65CB61000 1B000 8
[OverwatchDumpFix] 00007FF65CB7C000 1DA000 4
[OverwatchDumpFix] 00007FF65CD56000 1000 8
[OverwatchDumpFix] 00007FF65CD57000 13000 4
[OverwatchDumpFix] 00007FF65CD6A000 1000 8
[OverwatchDumpFix] 00007FF65CD6B000 24000 4
[OverwatchDumpFix] 00007FF65CD8F000 2000 8
[OverwatchDumpFix] 00007FF65CD91000 A7000 4
[OverwatchDumpFix] 00007FF65CE38000 191000 8
[OverwatchDumpFix] 00007FF65CFC9000 B000 4
[OverwatchDumpFix] 00007FF65CFD4000 4000 8
[OverwatchDumpFix] 00007FF65CFD8000 8000 4
[OverwatchDumpFix] 00007FF65CFE0000 3000 8
[OverwatchDumpFix] 00007FF65CFE3000 F0000 4
[OverwatchDumpFix] 00007FF65D0D3000 2F9000 8
[OverwatchDumpFix] 00007FF65D3CC000 106B000 4
[OverwatchDumpFix] 00007FF65E437000 13000 8
[OverwatchDumpFix] 00007FF65E44A000 1000 4
[OverwatchDumpFix] 00007FF65E44B000 3D000 8
[OverwatchDumpFix] 00007FF65E488000 3000 4
[OverwatchDumpFix] 00007FF65E48B000 17000 8
[OverwatchDumpFix] 00007FF65E4A2000 52000 4
[OverwatchDumpFix] 00007FF65E4F4000 1000 8
[OverwatchDumpFix] 00007FF65E4F5000 3000 4
[OverwatchDumpFix] 00007FF65E4F8000 18000 8
[OverwatchDumpFix] 00007FF65E510000 D000 4
[OverwatchDumpFix] 00007FF65E51D000 5000 8
[OverwatchDumpFix] 00007FF65E522000 2B0000 2
[OverwatchDumpFix] Deobfuscating the import address table...
[OverwatchDumpFix] Found the remote IAT: 00007FF65BD87000
[OverwatchDumpFix] ReadProcessMemory failed: 299. (Address = 00007FF65BD87000, Size = 0x2EE0)
[OverwatchDumpFix] Error: failed to enumerate IAT entries.
[OverwatchDumpFix] Error: failed to rebuild imports.
[OverwatchDumpFix] Failed to complete. Open an issue on github with the error message and log output:
[OverwatchDumpFix] GitHub - changeofpace/Overwatch-Dump-Fix: x64dbg plugin which removes anti-dumping and obfuscation techniques from the popular FPS game Overwatch.

[ostapus]

same issue here used to use namreeb's dumper but it is not working anymore. Would anyone give a hint/instruction how to deal with 11.2 retail ?

tia

[Saze03]

Sadly got the same problem rn...
(wow_loader.dll is loading properly)

Edit: I think the problem is the IAT encryption eidolon applies. So i try to decrypt and dump then - should do the trick

[luzifix.]

I'm having the same issue. Is there currently any other way to dump the memory?

[sunset123]

I'm having the same issue. Is there currently any other way to dump the memory?

Not what I have found, I'm tryin to fix it, let me know if you find a way

[Saze03]

ReadProcessMemory failed: 299

Lookup 299.

[sunset123]

Lookup 299.

How do we get around partial read I'm guessing eidolon causes it to be read protected. Do we somehow decrypt it before if so how?