Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
protector & obfuscator & code virtualizer
Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.
Dynamic Themida unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
A Binary Ninja plugin to detect Themida, WinLicense and Code Virtualizer's obfuscated code locations.
WIP PoC for license emulation in Oreans products
A Binary Ninja plugin to deobfuscate Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.
Generic Themida/WinLicense payload extractor. Launches protected PE as suspended process, detects section decryption, dumps unpacked binary with fixed headers, and scans process memory for IOCs. Supports EXE and DLL targets (x86/x64).
Windows tool for unpacking VMProtect-protected PE files from memory. Captures OEP, reconstructs IAT, harvests dynamic exec regions, integrates pe-sieve, extracts IOCs, and ships a password-protected archive. Supports EXE / DLL / service-DLL / dropper scenarios
Custom plugin example for Themida (DLLs) that will be embedded inside the protected binary.
protector & obfuscator
version 3.0.4.0 | x32 / x64
Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
Coordinate Themida protection jobs programmatically
To associate your repository with the themida topic, visit your repo's landing page and select "manage topics."