Reverse Engineering b10g | REM

Description:
TheMidaSpy tool was blacklisted and doesn’t work anymore then we updated the whole project and released a new tool source + templates for creating fake_kernel32.dll and fake_advapi32.dll for your themida loaders (Full C++ sources)

PEB dll hooker templates for MSVC
(c) 2008 deroko of ARTeam

Don’t know if anyone remembers themidaspy tool, which was designed to defeat
Anti-Break and Anti-ApiSpy techinques used in themida. I won’t go in details
how those are implemented in themida, as anyone, whom has played with themida
already know how those are implemented. TheMidaSpy tools was blacklisted, eg.
not working anymore with themida, so I decided to update whole project and
release new tool with sources (C) + templates for creating fake_kernel32.dll
and fake_advapi32.dll because you may find it usefull to use it in some of
your projects.

fake_kernel/advapi32 projects consist of all exports from both dlls. Currently,
I have listed all exports from kernel32.dll and advapi32.dll which are located
in those dlls on Windows XP SP3. Tnx to some of testers, I’ve received notification
that there are some exports and imports in fake_kernel32.dll/advapi32.dll
which are not present on XP SP2, on Vista on other hand, some imports are
not present, so you might wanna remove them if you plan to use this tool on
Vista.

I choose to use themida again, as it is good example when PEB hooking might
be handy, but you may use it for any other protection/project etc.

In themidaloader project you may find example how to inject these dlls into
targeted process.

You may find sample, on how to handle hooks in fake_kernel32 project, if
you lookup for f_GetModuleHandleA, f_LoadLibraryA, f_LoadLibraryExA, and
f_CreateThread, now it’s all up to you to decide how, and what you will
filter!!!

Compile HOWTO:

To compile sources, you will need MSVC 2005, and I think that there
shouldn’t be any problems if you compile it with MSVC 2008.

1. you will need to build fake_kernel32.dll and fake_advapi32.dll
solutions, and 2 dlls will be created in ..\..\fake\ folder.
2. in ..\..\fake\ folder you have adjust_fake.exe which you MUST use on
newly created dlls to get valid import table for kernel32/advapid32.dll
3. rebuild themida loader project, as fake_kernel32.dll and fake_advapi32.dll
are stored in resources of themidaloader.exe

You are free to modify sources, and use them as you like in any kind of
open source project If you use it in any kind of closed-source project,
have dignity, and at least mention my name

Enjoy…

(c) 2008 deroko of ARTeam

Greetings : talented reversers from ARTeam, woodmann, exetools and unpack.cn
forums… The only 4 reversing boards(sites) that I visit

From:
http://arteam.accessroot.com/releases.html

or

http://letitbit.net/download/a8a1dd466443/The-Mida-Loader-by-deroko.rar.html