dumpwow icon indicating copy to clipboard operation
dumpwow copied to clipboard

dumpwow doesn't seems to be unpacking SEH?

Open githubsearcher11 opened this issue 2 years ago • 1 comments

hello. while trying other unpacker to compare with result with dumpwow, i noticed one weird thing.

most of game engine functions seems to be unpacked without errors, but seems like obfuscated or protected function's SEH chain doesn't seems to be appearing when i thrown binary to IDA. this is very hearthbreaking as blizzard games abuses SEH a lot to obfuscate such function's call analysis.

changeofpace's ow unpacker seems to be giving valid SEH infos when thrown into IDA, through his plugin only targets to be recovering IAT only, and actual unpacking is indeed handled by game itself.

not sure what am i missing here, may i ask for your insight related with this issue?

githubsearcher11 avatar Jan 12 '24 07:01 githubsearcher11

also the TLS Callback doesn't seems to be valid either.

githubsearcher11 avatar Jan 12 '24 09:01 githubsearcher11