16 Kilobytes in the Clear: Decrypting Overwatch 2 Without Running It
Overwatch 2's 47 MB .text section ships encrypted at entropy 8.000, decrypted lazily one page at a time by Blizzard's Eidolon protector. The pad that decrypts it is 16 KB of plaintext bytes sitting in Overwatch_loader.dll, in the same folder, read circularly across the whole section. 99.84% of the game's code recovered from two files on disk - no key, no memory dump, no running process. Plus the 22 functions Eidolon guts entirely, and an honest account of the four times I fooled myself on the way.