x86rc/unthemidator

What it is

Unthemidator (x86rc/unthemidator) is a static unpacker for Themida, Code Virtualizer and WinLicense binaries. The page says it does not run the target or call its APIs or syscalls on the host. After unpacking it rebuilds the PE so the result can run and be debugged. The page lists these features: resource unpacking, VM decompression, import decryption with IAT restoration, VM version identification, and location of all Themida/CV entry points.

Preconditions / Affected

Supported protections are Themida, WinLicense and Code Virtualizer (compressed VMs) v3.0 to v3.2.6.0. Code Virtualizer v4.0 support is marked experimental. Precompiled builds exist for Windows x64 and macOS on Apple Silicon.

WinLicense targets need a license file, or unpacking will not succeed. Binaries that depend on custom modules need those modules placed in a modules directory beforehand. The same directory can hold missing system modules, which the page recommends for Unix hosts.

What to do

Run it by drag and drop, or from the command line:

unthemidator.exe [options] {path_to_bin.exe|.dll|.sys|.bin}
./unthemidator [options] {path_to_bin.exe|.dll|.sys|.bin}

Options that change the outcome:

• --license-file: required for WinLicense binaries.
• --out-file: defaults to {program_name}.unpacked.{program_extension}.
• --imports-file: JSON import report, defaults to {program_name}.imports.json.
• --vms-file: JSON list of VM entry points, defaults to {program_name}.vms.json.
• --vm-depth: number of virtualization layers to single-step for VM research and instruction tracing. The default is 0, so no VM exploration.
• --no-imp: skip import lookup.
• --no-vm-lookup: skip VM lookup.
• --no-startup: skip runtime startup processing. This prevents all unpacking except the initial boot stage.
• --no-loader: skip generating the anti-dump fixer loader.

The .imports.json and .vms.json outputs are the useful artifacts if the goal is analysis rather than just a runnable dump.

Caveats

• It does not devirtualize or unmutate code. Virtualized routines stay virtualized after unpacking.
• A file is treated as a kernel driver only if its extension is .sys. Everything else is parsed as a usermode binary, so a driver with another extension needs renaming.
• --no-loader may leave the binary unrunnable if the original entry point is virtualized or there are per-macro security checks.
• The page gives no success rates, tested sample counts or known failing versions. Problems are reported through repository issues.
• The page links three write-ups on Themida internals: the FALCON VM devirtualization article and a two-part LION VM analysis. These are the route for the devirtualization work the tool leaves undone.