Themida #2428

New issue

Open

opened 2026-10-17 21:04:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:04:32 +00:00

Owner

Originally created by @amirisback on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4662

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I understand the contribution scope must be reviewed before integration; open questions are welcome here.
This request does not include credentials, private samples, or sensitive target data.

Area

Not sure yet

Current limitation

By pass Proteksi / Packer: Oreans WinLicense / Themida

Use cases

No response

Desired outcome and success criteria

Proteksi / Packer: Oreans WinLicense / Themida

Expected interaction with targets

Read existing files or captured data

Target and scope details (optional)

No response

Verification available so far

I have a prototype or observed results

Verification details (optional)

Format: Native PE32 (x86 32-bit Executable).
SHA-256: 625dd66808516ad27bed75e33769a81cd249bf50f8933e2fce69307675183152
Ukuran: 12.603.984 bytes (~12.6 MB, 20 sections).
Proteksi / Packer: Oreans WinLicense / Themida
Section 15: .winlice (RVA 0x0104f000, VSize 0x00992000).
Section 16: .boot (RVA 0x019e1000, VSize 0x00618000).
Exports Penting:
__dbk_fcall_wrapper
dbkFCallWrapperAddr (Indikasi kuat: meminjam / mengintegrasikan wrapper driver kernel DBK Cheat Engine untuk direct kernel memory read/write).
Imports Inti: d3d9.dll (Direct3D overlay), winhttp.dll (auth server HTTP), user32.dll, gdi32.dll, comctl32.dll (antarmuka GUI desktop).

Alternatives considered

No response

Possible direction

No response

References

No response

Originally created by @amirisback on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4662 ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I understand the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope) must be reviewed before integration; open questions are welcome here. - [x] This request does not include credentials, private samples, or sensitive target data. ### Area Not sure yet ### Current limitation By pass Proteksi / Packer: Oreans WinLicense / Themida ### Use cases _No response_ ### Desired outcome and success criteria Proteksi / Packer: Oreans WinLicense / Themida ### Expected interaction with targets Read existing files or captured data ### Target and scope details (optional) _No response_ ### Verification available so far I have a prototype or observed results ### Verification details (optional) Format: Native PE32 (x86 32-bit Executable). SHA-256: 625dd66808516ad27bed75e33769a81cd249bf50f8933e2fce69307675183152 Ukuran: 12.603.984 bytes (~12.6 MB, 20 sections). Proteksi / Packer: Oreans WinLicense / Themida Section 15: .winlice (RVA 0x0104f000, VSize 0x00992000). Section 16: .boot (RVA 0x019e1000, VSize 0x00618000). Exports Penting: __dbk_fcall_wrapper dbkFCallWrapperAddr (Indikasi kuat: meminjam / mengintegrasikan wrapper driver kernel DBK Cheat Engine untuk direct kernel memory read/write). Imports Inti: d3d9.dll (Direct3D overlay), winhttp.dll (auth server HTTP), user32.dll, gdi32.dll, comctl32.dll (antarmuka GUI desktop). ### Alternatives considered _No response_ ### Possible direction _No response_ ### References _No response_

bsakaguchi added the

triage

enhancement

labels

2026-10-17 21:04:32 +00:00

bsakaguchi referenced this issue

2026-10-31 01:04:56 +00:00

[PR #2430] [MERGED] test(reference): scope cleanup faults to the owned source file #5221