Themida 2.3
i486 opened this issue · comments
This target has been quite painful, I might just stop to be honest.
- Debugger detection is pretty strict. Scylla's hooks are detected, so it must not be used. Magicmida's built-in bypasses work, but only on a 64-bit host.
- The usual way of preventing IAT wrapping doesn't work, possibly because this target only imports a single DLL and the code path that is forced by the patch is not taken during normal execution.
- The IAT code that crashes on said code path is doubly virtualized, which is an extreme pain to deal with.
I see a potential different way to fix the IAT stuff, but it'd require adding option switches to the unpacker, since it doesn't seem possible to determine beforehand whether the different way needs to be applied.