Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
themida-unmutate — Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation. | Kitploit
Tools/GitHubGitHub/ergrelet/themida-unmutate
Static AnalysisReverse EngineeringShellcodeMalware AnalysisBinary AnalysisBinary Exploitation
GitHubergrelet/themida-unmutate

themida-unmutate

Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

View Repository
380332 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

themida-unmutate

GitHub release Minimum Python version CI status

A Python 3 tool to statically deobfuscate functions protected by Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.
The tool has been tested on Themida up to version 3.1.9. It's expected to work on WinLicense and Code Virtualizer as well.

A Binary Ninja plugin is also available here.

Features

  • Automatically resolve trampolines' destination addresses
  • Statically deobfuscate mutated functions
  • Rebuild fully working binaries

Known Limitations

  • Doesn't support ARM64 binaries

How to Download

You can install the project with pip:

root@kitploit:~
pip install themida-unmutate

A standalone PyInstaller build is available for Windows in "Releases".

How to Use

Here's what the CLI looks like:

root@kitploit:~
$ themida-unmutate --help
usage: themida-unmutate [-h] -a ADDRESSES [ADDRESSES ...] -o OUTPUT [--no-trampoline] [--reassemble-in-place] [-v] protected_binary

Automatic deobfuscation tool for Themida's mutation-based protection

positional arguments:
  protected_binary      Protected binary path

options:
  -h, --help            show this help message and exit
  -a ADDRESSES [ADDRESSES ...], --addresses ADDRESSES [ADDRESSES ...]
                        Addresses of the functions to deobfuscate
  -o OUTPUT, --output OUTPUT
                        Output binary path
  --no-trampoline       Disable function unwrapping
  --reassemble-in-place
                        Rewrite simplified code over the mutated code rather than in a new code section
  -v, --verbose         Enable verbose logging
Download Tool