cccroswhite, posted Sat Jan 23, 2016 7:18 pm (10993)

---

CriticalError wrote:

you need provide full binaries, no only the file contain themida.

Hello, can you help with this

First at all, sorry for my bad english.

I can't get debug the executable with ollydbg, but i can't find (it's hard) the exactly jump to bypass the verification dongle key (HARDKey), because themida encript. But i found this foro with your instructions to unpack themida.

I did follow the steps to unpack themida, but after the step 10 i get the following error "Problem!WL Section not in stack to read - Wrong VirtualAlloc call from". I'm using VMWare Player 6.0.4 with Windows XP SP3.

The url with the executable that i can't unpack

https://drive.google.com/file/d/0ByeJr6CQUvcPVTFVNEI0Z2NveDg/view?usp=sharing


PS: I don't know if this executable is only protected by themida or other things. ProtectionId only show me themida.

Thanks in advance

rubens, posted Sat Jan 23, 2016 8:09 pm (10995)

---

now he ta thanking and creating a .ovr file ....
o'que would be a .ovr file?

AraHaan, posted Sat Jan 23, 2016 8:33 pm (10996)

---

I have a issue with downloading 1 of the deps to unpack these things. I need it for a hacking dll so I can debug why it crashes x2.exe with certain hacks.
PhantOm 1.79
^this thing would not download for me.
Had to install manually at another site but it ended up being newer. Also this dll seems to not be able to unpack right because I am using a x64 based OS on here.

The DLL here.

achov, posted Sat Feb 13, 2016 9:41 am (11390)

---

Hi. Can you help me to unpack an executable please? This is link for the exe: https://mega.nz/#!fEcCDRgT!udLx_hNlM62f ... dVfc-St8Bs

thank you so much!!!

rastaman29, posted Mon Feb 15, 2016 5:34 pm (11441)

---

At the end of execution of a script there is a window!

---------------------------
Themida
---------------------------
An internal exception occurred (Address: 0x7c2e50)

Please, contact [email protected]. Thank you!
---------------------------
??

12.rar

tisaygirl404, posted Fri Feb 19, 2016 2:44 pm (11525)

---

Hi sir i've been difficult to follow 40% i got error i use it on win xp 32 bit and windows 7 64 bit but unlucky i can't unpack can you try to unpack for me this plzzz here it is https://mega.nz/#!qc4SBYIZ!A4GO3FwVowe0 ... YCgS4bcw8s thanks in advance :* have a nice day

rubens, posted Sat Feb 20, 2016 8:52 pm (11556)

---

the phantom link 1.79 this offline you have this plugin there? I did not find on the internet tried a more advanced version and does not pass the script 13-14

deepminer2002, posted Mon Feb 29, 2016 6:34 pm (11696)

---

Can someone help me? When i do this everything is good only when i enable RDX my ollydbg crashes

CriticalError, posted Thu Mar 03, 2016 5:54 pm (11744)

---

this message was for all i'm not a programmer mates, so please stop send me PM, I can't help if you stuck in the process of unpack, I do the guide just for experience.

VRock, posted Wed Mar 09, 2016 3:08 pm (11873)

---

Hello, CriticalError.
When I tried to unpack two apps obfuscated by Themida 2.x.x I've got one problem, and I don't understand what's going on.
Status "terminated" appears after 16th step.
Can you help me to figure out with this, please?

farmith, posted Sun Mar 13, 2016 8:41 pm (11959)

---

Hi!

Love the tutorial, however i've been having alot of issues unpacking a file, mainly the issue is that i can not find the Direct VM OEP Address

the Themida script says "Rebuild Manually Push & JUMP Values!" but i have no idea how to do that, could you help?

it seems everything else works, ish, except the OEP.

//Rgds Farmith

marcioaraujo, posted Fri Mar 18, 2016 7:24 pm (12062)

---

Help me.
Problem! END IAT Pointer not found!

oisilener1982, posted Sat Mar 19, 2016 5:45 am (12070)

---

I am getting this Pusha Error I am using Windows 7 SP1 64 bit

This happened at Step 7. I clicked Yes and it is OK. I clicked No then Pusha Error

Below is the Protection ID Screenshot



Below is the program that i want to unpack. I paid for the program that I want to unpack but unfortunately it will only work in my PC because of HWID protection and it is also packed with themida.

Quote:

https://drive.google.com/file/d/0ByTHZVm-0I7Kc2hHSEVBSEw3UGs/view?usp=sharing

azreq02, posted Sun Mar 20, 2016 6:51 pm (12150)

---

Hey, I tried unpacking a dll themida but I cant :/ can anyone unpack please ?

Internet Filesi.zip

kfcsmitty, posted Mon Mar 28, 2016 6:53 pm (12288)

---

Hi, thanks for this tutorial!

Your unpacker seems to work properly until just before the "finished" message for me, when it says it was unable to dump the file and I would have to dump manually.

Are there troubleshooting steps you would usually give to someone in this scenario or anything that might help nudge me along?

Thanks,

Smitty


*edit* So my whole issue was because I was running the script on a .bin file. Changing the file extension to .exe fixed my issue.

TetraMan, posted Wed Apr 13, 2016 1:18 pm (12607)

---

Has anybody used this method against Themida 2.4?

I successfully unpacked an app protected by earlier Themida.

Now I am attempting unpacking of app protected by Themida 2.4

Some of the script popups are not appearing as expected (specifically, the very first popup during the first run - it does not appear... the application simply continues to run as normal), however, the script does produce a dump (unpacked) executable.

Upon running the unpacked version, however, it crashes with "... instruction at... referenced memory... The memory could not be read."

If anybody has successfully unpacked an app protected by Themida 2.4, did you use this method? Did the process go as outlined in the instructions? Did you do anything differently?

repahidis, posted Mon Apr 18, 2016 5:03 pm (12681)

---

hello, first thanks for tutorial. I make all steps same yours but I have an error like on screeenshoot. please give me a resolve, its make me angry

CriticalError, posted Mon Apr 18, 2016 7:49 pm (12686)

---

repahidis wrote:

hello, first thanks for tutorial. I make all steps same yours but I have an error like on screeenshoot. please give me a resolve, its make me angry

check correct path of ArImpRec.dll when you configure it in script.

andriuskk, posted Mon Apr 25, 2016 9:52 pm (12854)

---

*moderator edit* removed useless big quote.


Im need help for this https://drive.google.com/folderview?id= ... sp=sharing
Pls help me remove
It helps me to remove Security and Themida

This is autokill for muglobal webzen

more price for this hack is 20 usd/month
i need cracked this hack

erikeleria, posted Tue Apr 26, 2016 2:43 pm (12897)

---

Hello everyone. I need help. I was trying to unpack a game but in the middle of themida script running I hit a wall. I think this is only for 32bit systems 'coz I'm on a 64bit system. Would anyone tell me what to do or edit to make themida script run for 64bit system. It tells me to use TitanHide or ScyllaHide but I don't know what to do with it

OR

@CriticalError, can you unpack the exe for me?

lotficrew, posted Wed May 04, 2016 12:12 pm (13088)

---

IATSTART VA
and IATEND VA pointer not found in dump windows how fixe them ?

this is the softwar who i want to unpack it plzzzz helppp

http://www.cdma-ware.com/workshop/demo/cdma_workshop.rar

briggs, posted Mon May 16, 2016 5:25 pm (13460)

---

I ran your script and definitely was able to unpack my file (it at least a little bit) because I couldn't find any text strings or intermodular calls before and now I can. Also protectId tells me there is no more packing detected!! So that's good.

The problem is that the file is not executable anymore!!
-It crashes...
-Olly says: Bad or unknown format of 32-bit executable file 'msvcp100.dll'
-Olly says: Bad or unknown format of 32-bit executable file 'msvcr100.dll'

Also, there are still some things telling me the binary is packed:

-RDG Packer Detector tells me the binary is "probably" still packed with Themida (before it said Themida/Winlicense 2.x).
-Olly tells me that the binary has entry point outside of the code section and probably is compressed

So is the binary "half-unpacked"? What do I need to do?
Thanks for any help...

rubens, posted Sat May 28, 2016 12:56 am (13723)

---

PhantOm plugin 1.79 link broken link, new upload thank you

kimeknyaasu, posted Sat Jun 04, 2016 6:50 am (14023)

---

can you help me unpack a program?

kimeknyaasu, posted Sat Jun 04, 2016 9:56 am (14030)

---

Problem ! END IAT Pointer not found!