Reply:
I am always glad when someone tries to learn and grow.
![Smile :) :)](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
The information is relevant to FallenDoll and Paralogue (or anything else that uses ElecKey protection...). I posted the information in various places on the FallenDoll thread. Here is a decent summary:
This being x64, use x96Dbg. If you set any BPs on an executable protected by ElecKey, it'll muss it up. Remove all BPs. Then add a BP on "LoadLibraryA". If you get random "stalls", it is because you left a BP somewhere in the module. (Disable all, except for your LoadLibraryA)... Run. Allow the kernel to load EKC6420, let it execute
until it returns to main executable, step over the stack pointer add. You'll see a jmp just above before the call that caused the loading of EKC6420. Set EIP to follow, continue until you see a jmp rax (function end isn't a return but a simple jmp OEP). That is your jump to OEP. Step, you're now at OEP. 60 seconds tops.
IAT technically doesn't need rebuilding, you just need to undo ASLR, if you don't want a few skitzy AVs freaking out. If using Scylla for dumping, it doesn't correctly calculate some IAT sizes. Use original packed executable for that info. Wipe ssbt header AND from file (change section size, AND IMAGE SIZE). Rebase image to 140000000 (UE games...) OEP offset can be seen during those steps to jmp rax after that first jmp. Set your .text and .rdata sections to remove WRITABLE. They do not need it, skitzy AVs will also flag because of that. Pretty the timestamp. 5 minutes to do.
Basically, ElecKey adds a section to the PE header, and its own code to end of file, encrypts/scrambles/obfuscates .text section, sets OEP to ElecKey. Just undo those things and copy over your dumped .text section in this case. (That way you'll keep a clean IAT which is easier than rebasing...)
If in doubt, install Epic Games Launcher and make a 'do nothing' game just to compare executables. Remember, first executable is just a loader for second. .\WindowsNoEditor\Paralogue\Binaries\Win64\Paralogue-Win64-Shipping.exe is actual game.