Quick & Dirty Way to Bypass Themida Anti-Attach!
totally unlawful and you could be hold accountable for your actions in a court.
any kind of responsibility towards anything that, you ('the reader'), might do with such content.
close this page and continue browsing the forums as usual. If you continue reading it means you are automatically accepting this terms of agreement.
Don't Speak English? - Translate HERE! - No Eres Bueno en Ingles? - Traduce AQUI! - 不会说英语吗 - 英語を話すことはありません - Не говорить по-английски?
Epilogue: Probably the method that I'm going to be covering here it's not rocket science for some geniuses in the scene, or some other may have already knew it. However this method is geared towards people that doesn't know this approach yet, So keep on reading to find out how I did it, and see if you knew the approach already! if you would like to skip the story reading and you want to TL;DR go to where it says in big red bold letters, [TUTORIAL], last but not least, Hope you enjoy it!
So I was working on a Themida protected DLL, and such DLL was getting hooked at runtime by the game Entrypoint (e.g. push <DLLName>; jmp &LoadLibraryA; If DLL was found -> Continue Exec. else Jmp to Exit) Alright till here everything was good... Now when I started digging in it, I saw that... when I attached x64dbg to the process, it was getting terminated! So I said.. probably the program is protected with something... So here's where it gets interesting... The game executable wasn't protected with anything! but that just one module... so I said.. pretty cool that a DLL detects if a debugger is being attached... probably by Themida's API Hooking and I kept on going thinking to myself what could be wrong... Not so long passed that I was getting aggravated with it, the impossibility to do something with the program really got me badly.
0. CRITICAL STEP: Suspend your process at Startup! or after the troublesome Protected DLL loads!
To "suspend" a process after a specific DLL was loaded, I went and downloaded API Monitor, and went onto the API's and put a BP before DllMain call, that way when the offender DLL got called, the process was still being executed! the only difference is the DLL got loaded. It's one of my other "Quick and Dirty ways" of doing things Also since I'm working on x64DBG I used ScyllaHide to continue further progress... keep on reading to see how I executed everything.
1. Download PC Hunter (attached below for your convenience ;D) and extract it somewhere comfortable.
3. At the navigation tabs shown above, select "Ring3 Hooks".
8. Now just Right click and select Restore All... or if you had problems and/or your process exited/terminated abruptly while restoring all, just be selective and try one by one, I know it can be tedious, but at least it works... Most of the times you will be able to "Restore All".
Good, now we should have our process ready to continue loading... Now just remove all BP's at API Monitor (remember Step 0?) and resume execution... at this point your program should be running, normally.... Now Just go to x64DBG and in Plugins, go to ScyllaHide -> (remember to use Themida Preset) -> Attach to Process, and just use the little Pick Tool thingy, drag and drop it to your process and click attach!
If you followed up everything, you shall be at the DbgBreakIn on attach, just resume execution in x64DBG and viola! you have successfully bypassed the so Fearful, Themida's Anti-Attach!
Rohitab: for making API Monitor a great tool.
XueTr: for making PC Hunter free.
I wasn't aware PCHunter was still being developed?
Hi 0xNOP, yeah ... as you said, it's useful to find a way to make something work without changing your "environment configuration"
Sorry bro, can't help you there, Don't even know what you're asking for.