Themida/WinLicence latest version information

[ahmadmansoor]

you have to handle this by sure :
KERNELBASE.dll NtSetInformationProcess
KERNELBASE.dll NtQueryInformationProcess
KERNELBASE.dll NtClose
that should work ....
windows 10 suck , handle API not that easy .
try on windows 8.1 or 7 SP2

[dummys]

the problem is that it didn't run on Windows 7. msvcr80.dll crash.
Those Api should be handled by ScyllaHide. I tested it with ScyllaTest and it's ok.
Do you think that themida is doing kernel hook as well ?

[TechLord]

Originally Posted by ahmadmansoor

you have to handle this by sure :
...
windows 10 suck , handle API not that easy .
try on windows 8.1 or 7 SP2

Yes, also it seems that in the Creators Update of Win 10 to be released soon, the hooking of system processes/modules will not be allowed ...

So we need to come up with newer methods to hook and hide our debugging efforts. Or just keep using the older versions of Windows ...

[dummys]

Jeez, that's crap... What you do when you have no choice on the platform for reversing ?

So I was able to see the ring3 hooks with PC_Hunter, it's only ntdll.DbgUiRemoteBreakin. There is no ring0 hook (oreans driver not loaded). When I restore the ring3 hooks and then attach my debugger it's working. But when starting a "secure" function, then debugee does nothing.