Example Usage
$ themida-unmutate --help
usage: themida-unmutate [-h] -a ADDRESSES [ADDRESSES ...] -o OUTPUT [--no-trampoline] [--reassemble-in-place] [-v] protected_binary
Automatic deobfuscation tool for Themida's mutation-based protection
positional arguments:
protected_binary Protected binary path
options:
-h, --help show this help message and exit
-a ADDRESSES [ADDRESSES ...], --addresses ADDRESSES [ADDRESSES ...]
Addresses of the functions to deobfuscate
-o OUTPUT, --output OUTPUT
Output binary path
--no-trampoline Disable function unwrapping
--reassemble-in-place
Rewrite simplified code over the mutated code rather than in a new code section
-v, --verbose Enable verbose logging
See also
soSaver
Open Source
A Frida-based utility for dynamically extracting native (.so) libraries from Android applications.…
Unicorn
Open Source
Simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Works…
LOLBAS
Open Source
Living Off The Land Binaries And Scripts — documents Windows native binaries that can be abused for …
SwizGuard
Open Source
A self-hosted "Stealth VPN" implementation, forked from xray-core and WireGuard. It makes your traff…
DojoLoader
Open Source
Generic PE loader for fast prototyping evasion techniques…
goodboy-framework
Open Source
15-stage Windows malware development & analysis course in Rust. Red team builds it, blue team detect…