Themida v2.x.x.x OEP Finder.txt

//Tested on Themida v2.4.6.0
//Always use an anti-anti-debug plugin (SharpOD, ScyllaHide, etc.)

msg "Themida v2.x.x.x OEP Finder by Yildo & Mobile46"

//Clear or disable breakpoints
//bpc
//bphc
//bpmc
bpd
bphd
bpmd

//Start
mov $sectionAddress, mod.main() + mem.size(mod.main())

cmp mem.isvalid($sectionAddress), 0
je error

cmp mem.iscode($sectionAddress), 0
je error

mov $backup, [$sectionAddress]
bph VirtualProtect

loop:
erun
cmp [$sectionAddress], $backup
jne continue

jmp loop

continue:
erun
erun

bphc VirtualProtect
bpm $sectionAddress, x

erun
d
cmt cip, "OEP"
ret

error:
msg "This PE file is not supported!"
ret