A Python 3 tool to statically deobfuscate functions protected by Themida, WinLicense and Code Virtualizer 3.x’s mutation-based obfuscation.
The tool has been tested on Themida up to version 3.1.9. It’s expected to work on WinLicense and Code Virtualizer as well.
A Binary Ninja plugin is also available here.
You can install the project with pip
:
pip install themida-unmutate
A standalone PyInstaller build is available for Windows in “Releases”.
Here’s what the CLI looks like:
$ themida-unmutate --help
usage: themida-unmutate [-h] -a ADDRESSES [ADDRESSES ...] -o OUTPUT [--no-trampoline] [--reassemble-in-place] [-v] protected_binary
Automatic deobfuscation tool for Themida's mutation-based protection
positional arguments:
protected_binary Protected binary path
options:
-h, --help show this help message and exit
-a ADDRESSES [ADDRESSES ...], --addresses ADDRESSES [ADDRESSES ...]
Addresses of the functions to deobfuscate
-o OUTPUT, --output OUTPUT
Output binary path
--no-trampoline Disable function unwrapping
--reassemble-in-place
Rewrite simplified code over the mutated code rather than in a new code section
-v, --verbose Enable verbose logging
This Python script for Linux can analyze Microsoft Windows *.msi Installer files and point out…
Bear C2 is a compilation of C2 scripts, payloads, and stagers used in simulated attacks…
Discover your application security risks and vulnerabilities in only a few minutes. In this guide…
The idea behind waymore is to find even more links from the Wayback Machine than…
The Pycript extension for Burp Suite is a valuable tool for penetration testing and security…
For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and…