Before we continue I'd like you to keep in mind I'm relatively new to unpacking executables. So I have a few
Recently I've been trying to unpack an executable (x64 architecture), aka find the OEP and restore the IAT, that is packed with Themida x64:
I've tried breakpointing at LoadLibraryA. I've read thats a great way to solve it.
However, I do not know what to do next. It brings me to this page:
00007FFE291AA240 | 48 89 5C 24 08 | mov qword ptr ss:[rsp+8],rbx | 00007FFE291AA245 | 48 89 74 24 10 | mov qword ptr ss:[rsp+10],rsi | [rsp+10]:LoadLibraryA 00007FFE291AA24A | 57 | push rdi | 00007FFE291AA24B | 48 83 EC 20 | sub rsp,20 | 00007FFE291AA24F | 48 8B F9 | mov rdi,rcx | rcx:"USER32.dll" 00007FFE291AA252 | 48 85 C9 | test rcx,rcx | rcx:"USER32.dll" 00007FFE291AA255 | 74 15 | je kernelbase.7FFE291AA26C | 00007FFE291AA257 | 48 8D 15 FA 2F 10 00 | lea rdx,qword ptr ds:[7FFE292AD258] | 7FFE292AD258:"twain_32.dll" 00007FFE291AA25E | FF 15 B4 C9 0F 00 | call qword ptr ds:[<&_stricmp>] | 00007FFE291AA264 | 85 C0 | test eax,eax | 00007FFE291AA266 | 0F 84 72 A8 03 00 | je kernelbase.7FFE291E4ADE | 00007FFE291AA26C | 45 33 C0 | xor r8d,r8d | 00007FFE291AA26F | 33 D2 | xor edx,edx | 00007FFE291AA271 | 48 8B CF | mov rcx,rdi | rcx:"USER32.dll" 00007FFE291AA274 | E8 17 00 00 00 | call <kernelbase.LoadLibraryExA> | 00007FFE291AA279 | 48 8B 5C 24 30 | mov rbx,qword ptr ss:[rsp+30] | [rsp+30]:LoadLibraryA 00007FFE291AA27E | 48 8B 74 24 38 | mov rsi,qword ptr ss:[rsp+38] | 00007FFE291AA283 | 48 83 C4 20 | add rsp,20 | 00007FFE291AA287 | 5F | pop rdi | 00007FFE291AA288 | C3 | ret |
I've gotten a few addresses where it finds the API's, but it doesnt load all of them! (from what I have seen)
For example, this one address I had loaded only Windows libs (kernel32.dll, KernelBase.dll, ...), but due to it missing a ton of libs (DirectX, OpenGL, ...), I threw it off as not being the OEP.
I've unpacked files packed with UPX, Themida is stumping me.
All help is appreciated! Thank you :)