crtdll / ida-gameguard-str-dec

IDA script to dump out and label encrypted strings in nProtect GameGuard modules. Tested on Helldivers2

GameGuard String Decryption (IDA)

This script is designed to identify the decryption function within any GameGuard module, decrypt strings passed to it and subsequently label them in both the decompilation and assembly, while also outputting them to a file.

Usage

Load your preferred GameGuard module dump into IDA, then utilize File -> Script File to load it.

Notes

Some interesting strings to look out for:

x64dbg.exe
[IsScanSkip] skip: WhiteList. %d, %ws
d3dhook.dll
Inject Check: %lu, %s
SUSPECT_KERNEL_MANIPULATION
Scan64Thread SuspendThread
checkp text section md5 : %s
checkp md5 : %d, %s
GG_GRT_VIRUS
\kaspersky lab\
MD5 Succ %d %d
BinaryPattern Succ %d %d
Check threads(%d): h:%d %d (%d)
e8: %x %x (%x): %x %x %x %x %x %x %x %x %x
[LS] checkpkernelmem, addr: %p, base: %p size: %x, image: %s, i: %d
(PID: %lu, Ret: %p) BitBlt(%x, %d, %d, %d, %d, %x, %d, %d, %x)
process allowed, API : %02x, procHash : %08x