-
x64dbg ScyllaHide NtUser* API Address missingComputer/Program Analysis 2016. 9. 20. 15:29
I encountered following message box while I am using x64dbg + scyllahide.
In the manual (ScyllaHide.pdf), it says that we need to download NtAPITool.rar and copy NtAPICollection.ini to x64\plugins folder.
But the NtAPITool.rar does not fix this error.
The OS minor version of the ini file is incorrect. So we need to fix the OS minor version.
I am using Windows 8.1, so the OS minor version is 3. So the first line needs to be changed into '[0603.....]'
Then x64dbg works very well.
However PDBReader32.exe does not work giving it cannot connect to the symbol server.
So I tried to install Windows Debugger in Windows SDK.
In the windows debugger,
1) set symbol path
2) load user32.dll
3) query interested function addresses
4) calculate RVA (function address - user32 base address) and update NtAPICollection.ini