2

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there were some errors apparently. So my question is this, when i run that game.exe and i attach xdbg64 to it, it shows me the assembly code of the whole process, but when i instead run that game and try to attach Ida Pro's debugger to it i don't get the same kind of information, so is there a way to display the whole program's assembly in Ida pro and also use the decompiler on some of the function while the game.exe is running? My goal is to make a single player mod for this game by hooking a specific funtion. I attached two screenshots that show the same address for both programs:

xdbg64:

xdbg64

idaProFree:

idaProFree

1 Answer 1

1

As far as I can see, you are using the STEAM-version of the game. And also the fact that the publisher of the game: Bethesda, which reliably protects its investments and likes to sue others.

That was the preface, and now, about the case:

STEAM games are very often packaged. Therefore, it is not always possible to work with them in IDA Pro directly without unpacking.

From here your first question should be: is the game packaged? yes - find unpacker or download drm-free image from gog.com

in addition, the game may have anti-debugging tricks and IDA Pro has a tool to bypass them:

How to hide Remote Windows Debugger in IDA Pro?

How to determine if an executable is packaged?

If you can open this file in IDA Pro without problems and see a bunch of functions, then most likely this file is not packaged.

If the file is packed and there is a call to STEAM-api functions then, there is a solution for a long time:

Steamless, active fork

If your goal is to write a cheat - try using the Cheat Engine, as well as the specialized forums: https://unknowncheats.me

1
  • Thank you, is there a way to determine if/when a game is packaged or should i just assume they are on Steam ? However, the general method of using the debugger of ida to analyse/decompile certain specific functions of the running .exe makes sense compared to analyse the whole .exe file when it's not running?
    – EncoderX
    Nov 26, 2022 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.