x86rc/unthemidator

If you analyze Windows binaries wrapped in Themida, WinLicense or Code Virtualizer, Unthemidator is worth a look, but treat it as a research tool rather than a solved pipeline: it rebuilds a runnable PE and identifies VM versions, yet leaves the devirtualization work to you.

The problem

A packed sample arrives and the usual workflow is to run it under a debugger, chase the protection's startup checks and try to walk to the real entry point before dumping memory. That is slow, and on virtualized code the original entry point may sit behind VM layers. Unthemidator instead reads the file and processes the protection's boot and runtime startup stages without executing the target, then performs a full PE rebuild and writes the result to disk. The user ends up with a parsed binary, import information and VM entry-point locations without having to instrument a live process.

What's different

The README states the tool never runs the target binary and does not call APIs or syscalls used by the target on the host, and that it handles DLLs, EXEs, SYS files and other Windows binaries in 32- and 64-bit variants project instructions. Beyond dumping, it decrypts imports and restores the IAT, unpacks resources, decompresses virtual machines and locates every Themida/Code Virtualizer entry point, emitting imports and VM data as JSON. That combination is what makes it more than a generic dumper: you get structured output you can feed into further analysis rather than a raw memory image.

The trade-off is explicit in the limitations: it will not devirtualize, unmutate or otherwise deobfuscate code project instructions. If you need readable logic from VM-protected functions, unpacking is the first step, not the answer. Kernel drivers are only recognized as such via the .sys extension, so files with other extensions are parsed as usermode applications by default. There is also a loader option whose omission may leave the binary unrunnable when the OEP is virtualized or per-macro checks exist, so the defaults matter.

Who should try it

Good fit: reverse engineers and malware analysts who already work with packed Windows samples, want a faster route to a dump and import table, and plan to continue analysis in their own tooling. The author's write-ups on Themida's FALCON and LION virtual machines provide useful background for that follow-up work FALCON VM article LION VM articles.

Poor fit: anyone expecting a one-step deobfuscator, or analysts who need to run the unpacked binary on the same Unix host. Unix support exists, but binaries that rely on custom or missing system modules need those files placed in a modules directory first. The experimental Code Virtualizer v4 support is also worth treating as such rather than as a stable target.

Requirements and limitations

Precompiled builds are listed for Windows x64 and macOS Apple Silicon releases; there is no Linux binary listed, so Unix users on other platforms would need to build from source. Custom modules must be staged before unpacking when a sample depends on them, and that preparation is easy to miss. The supported protection range is documented as Themida and WinLicense 3.0 through 3.2.6.0 and Code Virtualizer compressed VMs in that range, with v4 marked experimental, so newer protections fall outside the stated scope. No license is declared, which is a practical issue if you intend to redistribute or integrate the tool rather than use it privately.

HotRepo's take

HotRepo first recorded the project on 2026-10-24 and saw it at #9 on the NEW-REPOSITORY board for cpp on 2026-10-25, with 150 total stars; that is a new-project board rank, not overall Trending, and it covers a single recorded date. With two days of age and one snapshot, persistence cannot yet be judged. Before investing, check whether the binaries you care about fall inside the documented protection version range and whether the missing license terms fit your intended use.