1

I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone please help me to dump dll?

Dll is part of Watch Dogs game(It's called Disrupt_b64.dll) and it has VMProtector. When I opened dll in IDA I first got error: Can't find translation for relative virtual address 03ACF000, continue? After that I got error: The imports segment seems to be destroyed. This MAY mean that the file was packed or otherwise modified in order to make it more difficult to analyze.

When I opened dumped dll from Scylla I only got second error

Someone on I read on this site https://blog.lms-dev.com/category/watch-dogs/ successfully got that lua functions(collectgarbage, dofile, error, gcinfo). He said on site to unpack dll attach IDA to the process and dump the loader segments.

Disrupt_b64.dll looked like this Disrupt_b64.dll Dumped Disrupt_b64.dll looked like this Dumped Disrupt_b64.dll

  • 1
    Please add technical details about your problem. For example, how do you know the dll is packed, have you tried to identify the packing technique/packer, what game is the dll part of, what methods of analysis have you tried, what exactly happened when you used Scylla, etc – julian Feb 26 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.