How to Dump Wow from Memory....

[plecharts]

I've tried following this for Classic and have built/added the ScyllaHide and OverwatchDumpFix plugins, both of them work (or at least appear to) without error. However, when I run IAT Autosearch in Scylla it tells me that the results of normal and advanced search are different. If I select to use the advanced search result and then click GetImports, then it will find 565 valid APIs and miss 2 APIs. Now if I click Dump, it will tell me "Error: Cannot dump image". Does anyone know how to fix this?

Use the x64dbg linked in the main post

[badusername1234]

Use the x64dbg linked in the main post

Oh cheers, I should have tried that. I used the one that Namreeb linked in a recent post because I figured it fixed an issue I'd run into but it seems to have just worked

[xkyii]

Oh cheers, I should have tried that. I used the one that Namreeb linked in a recent post because I figured it fixed an issue I'd run into but it seems to have just worked

Does it work for Wow Classic 1.13.2.31727 now? I tried with x64dbg(snapshot_2019-09-01_17-37) and failed at Dump step with "Error: Cannot dump image".

[badusername1234]

Does it work for Wow Classic 1.13.2.31727 now? I tried with x64dbg(snapshot_2019-09-01_17-37) and failed at Dump step with "Error: Cannot dump image".

Dumping only seems to work with the specific version linked at the beginning of the thread, just get that one for dumping with

Don't ask me how to get it to debug though because I haven't tried to get that working yet

[xkyii]

Dumping only seems to work with the specific version linked at the beginning of the thread, just get that one for dumping with

Don't ask me how to get it to debug though because I haven't tried to get that working yet

Thank you buddy!

Of cource next question is how to debug...

Wow_dump.exe and Wow_dump_SCY.exe can't run directly, more further work is needed to do this right?

Or, it can only be statically but not dynamically debugged?

[badusername1234]

Thank you buddy!

Of cource next question is how to debug...

Wow_dump.exe and Wow_dump_SCY.exe can't run directly, more further work is needed to do this right?

Or, it can only be statically but not dynamically debugged?

You don't want to run either of those files, you should open wow_dump_scy.exe in ida or whatever you're using. Debug the actual game instead of the dump file, though I'm not sure how to make that work properly atm

[NoxiaZ]

Hi,

I'm starting to get tired of that i cant get this to work, and seems that it is working for everyone else beside me.. :/
So now i have to ask, what am i doing wrong, i'm following step by step, but with no luck - I have to inform that C++ isn't my strongest side, and therefor not able to solve the build errors i get.



1. I download x64dbg from: Download x64dbg from SourceForge.net
2. I unzip into "D:\Temp\WoW\x64dbg" - Run the exe file located in "D:\Temp\WoW\x64dbg\release\x64" and close the program again
3. I download ScyllaHide from GitHub - x64dbg/ScyllaHide: Advanced usermode anti-anti-debugger - By pressing "Download ZIP"
4. I unzip it to "D:/Temp/WoW/ScyllaHide-master"
5. I open the ScyllaHide.sln to build the project
6. In VS, i change Win32 to x64 - After that i click "Build" -> "Rebuild solution"
7. First i see 3 errors "Cannot open include file: 'idp.hpp': No such file or directory" in the Porject ScyllaHideIDAProPlugin - But when i press build again they disappear.
8. I go to the build folder "D:\Temp\WoW\ScyllaHide-master\build\Debug\x64" and locate "HookLibraryx64.dll" and "ScyllaHideX64DBGPlugin.dp64
9. I copy the files to plugin folder for x64dbg as written.
10. now i have to run the file "PDBReaderx64.exe" - but this is not located anywhere on my harddrive


I have no clue how to get this file, i have been searching for it every where, but cant find it. So again, what am i doing wrong?

[SailorMars]

Hi,

I'm starting to get tired of that i cant get this to work, and seems that it is working for everyone else beside me.. :/
So now i have to ask, what am i doing wrong, i'm following step by step, but with no luck - I have to inform that C++ isn't my strongest side, and therefor not able to solve the build errors i get.



1. I download x64dbg from: Download x64dbg from SourceForge.net
2. I unzip into "D:\Temp\WoW\x64dbg" - Run the exe file located in "D:\Temp\WoW\x64dbg\release\x64" and close the program again
3. I download ScyllaHide from GitHub - x64dbg/ScyllaHide: Advanced usermode anti-anti-debugger - By pressing "Download ZIP"
4. I unzip it to "D:/Temp/WoW/ScyllaHide-master"
5. I open the ScyllaHide.sln to build the project
6. In VS, i change Win32 to x64 - After that i click "Build" -> "Rebuild solution"
7. First i see 3 errors "Cannot open include file: 'idp.hpp': No such file or directory" in the Porject ScyllaHideIDAProPlugin - But when i press build again they disappear.
8. I go to the build folder "D:\Temp\WoW\ScyllaHide-master\build\Debug\x64" and locate "HookLibraryx64.dll" and "ScyllaHideX64DBGPlugin.dp64
9. I copy the files to plugin folder for x64dbg as written.
10. now i have to run the file "PDBReaderx64.exe" - but this is not located anywhere on my harddrive


I have no clue how to get this file, i have been searching for it every where, but cant find it. So again, what am i doing wrong?

It should work on the latest wow version (as of 9Nov2019). This was the one i tried successfully.
1) make sure you run the x64 verison of x64dbg.
2) you should try using the compiled binary of ScyllaHide (click "release" tab and choose ScyllaHide_2019-05-31_22-45.7z) instead of compiling from the src. You need to generate a NtApiCollection.ini for your OS by running PDBReaderx64.exe. This exe is not included in the source code. Probably this is the step you missed.
3) i encountered the "missing idp.hpp" problem too but i guess it is irrelevant since it is the plugin for IDA and we need a plugin for x64dbg only which can be generated successfully (for me). Anyway, you don't need to compile from the src, just use the pre-compiled binary.

[NoxiaZ]

It should work on the latest wow version (as of 9Nov2019). This was the one i tried successfully.
1) make sure you run the x64 verison of x64dbg.
2) you should try using the compiled binary of ScyllaHide (click "release" tab and choose ScyllaHide_2019-05-31_22-45.7z) instead of compiling from the src. You need to generate a NtApiCollection.ini for your OS by running PDBReaderx64.exe. This exe is not included in the source code. Probably this is the step you missed.
3) i encountered the "missing idp.hpp" problem too but i guess it is irrelevant since it is the plugin for IDA and we need a plugin for x64dbg only which can be generated successfully (for me). Anyway, you don't need to compile from the src, just use the pre-compiled binary.

Thank you so much for you time and answer. This was a great help

I didn't notice the "release" tab, and now i generated the NtApiCollection.ini, seems i need a bit more for being able to build the OverwatchDumpFix - I think it was "v120 build tools" but now i'm updating VS so hopefully i can compile that after.

But again, thank you so much.

[NoxiaZ]

I have been trying to compile the project "OverwatchDumpFix", but with no luck, so again i have to ask what i'm doing wrong

I download it from GitHub - changeofpace/Overwatch-Dump-Fix: x64dbg plugin which removes anti-dumping and obfuscation techniques from the popular FPS game Overwatch. and unzip it into D:\Temp\WoW\Overwatch-Dump-Fix-master

I have VS 2017 Enterprise installed, and installed nearly all components where "c++" is in the name
When i open the SLN file it says that i should retarget the solution, i tried not to do that, but then i get an error with missing VS120 build tools, i have tried everything to install VS120 build tools, but i cant figure it how to get it without install VS2013 (which i cant locate anymore)

So i tried retarget the project instead, but then im getting another error "Cannot open include file: 'Windows.h': No such file or directory" - The same goes for the file "basted.h"
Hope someone again can help me.

[counted]

I just did a clean git clone of overwatchdumpfix and opened it with MS Community 2019 and it builds fine no errors.

Try a clean clone and Visual Studio Community 2019

[NoxiaZ]

I just did a clean git clone of overwatchdumpfix and opened it with MS Community 2019 and it builds fine no errors.

Try a clean clone and Visual Studio Community 2019

Thank you so much for your reply, i tried compiling it on my laptop from my work, also with VS 2017 enterprise, but that worked perfectly.
So i guess it's something on my computer that makes the problem, but what it is, i don't know.

But now i can continue, so that's perfect.

[badusername1234]

Just a note - I tried to do this using the latest versions of everything (latest x64dbg, latest overwatchdumpfix, latest scyllahide) and it seems to have successfully dumped/fixed the wow binary, so maybe there is no longer a need to use the older version of x64dbg

[Hellmessage]

123.jpg

Scylla Error

[airjqqq]

I have tried several build of x64dbg and keep popping Scylla Error once i click plugin->scylla. Even if i attach notepad.exe process. Could anyone give me some hits?