x86rc/unthemidator

选用指南

AI 根据 README 整理 · 2026/10/27 06:11:25

使用方式

通过命令行运行，支持 Windows 和 Unix 系统，也可拖放文件到程序图标。

查看 README 依据

- [x] Location of all Themida/CV entry points ## How to Simply drag and drop a packed binary onto unthemidator or use the following CLI command on Windows: ```bash unthemidator.exe [options] {path_to_bin.exe|.dll|.sys|.bin} ``` and the following CLI command on a Unix-based system: ```bash ./unthemidator [options] {path_to_bin.exe|.dll|.sys|.bin} ``` A PE will only be considered a kernel driver if its file extension is **.sys**. This is done to ensure correct parsing of files with any extensions as usermode applications by default.

部署要求

支持 Windows、macOS（Apple Silicon）预编译版本，需要输入受保护的文件。

查看 README 依据

- [x] Location of all Themida/CV entry points ## How to Simply drag and drop a packed binary onto unthemidator or use the following CLI command on Windows: ```bash unthemidator.exe [options] {path_to_bin.exe|.dll|.sys|.bin} ``` and the following CLI command on a Unix-based system: ```bash ./unthemidator [options] {path_to_bin.exe|.dll|.sys|.bin} ``` A PE will only be considered a kernel driver if its file extension is **.sys**. This is done to ensure correct parsing of files with any extensions as usermode applications by default.

If you have a problem or something isn't working as intended (or not working at all), create an issue in this repository. ## Download Check out the [Releases](https://github.com/x86rc/unthemidator/releases) page to find precompiled unthemidator. Currently, the following variants are available: - Windows x64 executable - macOS (Apple Silicon) executable ### Supported Themida versions: - Themida v3.0 - v3.2.6.0 - Win License v3.0 - v3.2.6.0 - Code Virtualizer (compressed VMs) v3.0 - v3.2.6.0 - Code Virtualizer (compressed VMs, **experimental**) v4.0 ### Limitations

已知限制

不能去除代码混淆（如虚拟机反虚拟化、变异），且某些选项可能导致二进制不可运行。

查看 README 依据

- `--no-loader` - skip anti-dump fixer loader generation. This may make the binary unrunnable if the OEP is virtualized or there are per-macro security checks #### Custom Modules Some binaries rely on custom modules shipped with the program. You can simply put all custom modules in the `modules` directory before unpacking such binaries. The same can be done for missing system modules, which is useful if you're running unthemidator on a Unix system. #### Reporting Issues

- This will not deobfuscate (devirtualize, unmutate) code ### Research, documentation and useful links Learn more about Themida obfuscation internals, including its virtual machines, in the following articles: 1. [Devirtualizing Themida's (Code Virtualizer) FALCON VM to readable code](https://blog.shablyko.com/posts/themida-falcon-devirt/). Documentation of the Themida / CV research process, starting with no prior VM knowledge or complex tools.