Themida x64 architecture decision vulnerability exploit to unpack protected targets

[loggedout]

I just came across to this video on YouTube and thought it will not be a bad idea to share it with the community, and I don't know if this is new for some people or not but...

 

[Aesculapius]

hello, this is not a vulnerability of themida, its a vulnerability of process hollowing procedure if you don't take the precaution of protecting the injected process itself. If you use the protection in a wrong way, then it stops being secure. Themida is alright. This is a rare example of one very bad implementation of themida and it can happen to any other protector if bad implemented.

Edited February 1, 2018 by Aesculapius

[samoray]

Very interesting technique

[cachito]

It is easier with megadumper...

[collins]

yes, the app add Themida x64 protected is weakness.  Just megadumper + de4dot .

[V65j]

where is the video?

any one can upload it again?

[jameswoods]

No sure if it is the same video but its the same idea