Quote:
Originally Posted by Lungi
how do you get raw memory dump from engine.dll?
ghidra or anything else?
|
usually engine.dll is packed with Engima packer which has flaws against anti-debugging which allows you to view raw memory, as long as you let the game fully load (unpacking the engine.dll) you can attach IDA PRO 8.3 (make sure you run it as administrator or it won't attach). You can also use x64dbg with plugin ScyllaHide (this plugin completely bypasses the anti-debugging of Engima), you can even run the game without it crashing while debugging with x64dbg. Make sure you bypass the xtrap first as this one is strong and won't allow debugging to bypass xtrap you need to strip it away from Engine.exe from loading completely.
Get your tools from: