Unpacking a Themida packed x64 executable?

Question

Before we continue I'd like you to keep in mind I'm relatively new to unpacking executables. So I have a few

Recently I've been trying to unpack an executable (x64 architecture), aka find the OEP and restore the IAT, that is packed with Themida x64:

I've tried breakpointing at LoadLibraryA. I've read thats a great way to solve it.

However, I do not know what to do next. It brings me to this page:

00007FFE291AA240 | 48 89 5C 24 08           | mov qword ptr ss:[rsp+8],rbx           |
00007FFE291AA245 | 48 89 74 24 10           | mov qword ptr ss:[rsp+10],rsi          | [rsp+10]:LoadLibraryA
00007FFE291AA24A | 57                       | push rdi                               |
00007FFE291AA24B | 48 83 EC 20              | sub rsp,20                             |
00007FFE291AA24F | 48 8B F9                 | mov rdi,rcx                            | rcx:"USER32.dll"
00007FFE291AA252 | 48 85 C9                 | test rcx,rcx                           | rcx:"USER32.dll"
00007FFE291AA255 | 74 15                    | je kernelbase.7FFE291AA26C             |
00007FFE291AA257 | 48 8D 15 FA 2F 10 00     | lea rdx,qword ptr ds:[7FFE292AD258]    | 7FFE292AD258:"twain_32.dll"
00007FFE291AA25E | FF 15 B4 C9 0F 00        | call qword ptr ds:[<&_stricmp>]        |
00007FFE291AA264 | 85 C0                    | test eax,eax                           |
00007FFE291AA266 | 0F 84 72 A8 03 00        | je kernelbase.7FFE291E4ADE             |
00007FFE291AA26C | 45 33 C0                 | xor r8d,r8d                            |
00007FFE291AA26F | 33 D2                    | xor edx,edx                            |
00007FFE291AA271 | 48 8B CF                 | mov rcx,rdi                            | rcx:"USER32.dll"
00007FFE291AA274 | E8 17 00 00 00           | call <kernelbase.LoadLibraryExA>       |
00007FFE291AA279 | 48 8B 5C 24 30           | mov rbx,qword ptr ss:[rsp+30]          | [rsp+30]:LoadLibraryA
00007FFE291AA27E | 48 8B 74 24 38           | mov rsi,qword ptr ss:[rsp+38]          |
00007FFE291AA283 | 48 83 C4 20              | add rsp,20                             |
00007FFE291AA287 | 5F                       | pop rdi                                |
00007FFE291AA288 | C3                       | ret                                    |

I've gotten a few addresses where it finds the API's, but it doesnt load all of them! (from what I have seen)

For example, this one address I had loaded only Windows libs (kernel32.dll, KernelBase.dll, ...), but due to it missing a ton of libs (DirectX, OpenGL, ...), I threw it off as not being the OEP.

I've unpacked files packed with UPX, Themida is stumping me.

All help is appreciated! Thank you :)

Answer 1

Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business trying to unpack Themida. Here's why:

Themida uses an extremely complex virtual machine environment combined with every anti-debug and anti-analysis trick in the books, combined with many different obfuscation methods. For example, in a UPX packed binary, you just need to find OEP and dump it down before finally rebuilding the IAT. In a Themida binary, different parts of the code are run in virtual machines and it obscures the behavior of the target program. The best method to unpack a VM-protected packer like Themida is to devirtualize it, which involves figuring out the entire instruction set that the packer uses and writing a script to interpret that language. All of that is only one step. Themida also severely obstructs the import address table, splits up the entire program and only loads one portion at a time (this prevents you from "dumping" the entire program like you did with UPX) and then unloads it on a per-routine basis, and implements a bunch of anti-analysis tricks, many of which are listed on their website.

Additionally, you will need to know the exact version of Themida you are dealing with. Themida is so complicated to unpack that most people write scripts and so you can search for a script for the given version you are trying to unpack and attempt to use that. If the version is new and there is no script, given your level of expertise right now, this will be a very, very long and arduous task.

Further reading:

A Generic Approach to Automated Deobfuscation of Executable Code

Anti-Unpacker Tricks by Peter Ferrie

Themida/WinLicense Manual Unpack tutorial