Update default Themida settings profile

Support for the latest Themida is incomplete, see #127
x64dbg · Aug 23, 2021 · 7e648fb · 7e648fb
1 parent 2276f14
commit 7e648fb
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/ConfigCollection/scylla_hide.ini b/ConfigCollection/scylla_hide.ini
@@ -112,9 +112,9 @@ GetSystemTimeHook=0
 GetTickCount64Hook=0
 GetTickCountHook=0
 KiUserExceptionDispatcherHook=0
-NtCloseHook=0
+NtCloseHook=1
 NtContinueHook=0
-NtCreateThreadExHook=0
+NtCreateThreadExHook=1
 NtGetContextThreadHook=0
 NtQueryInformationProcessHook=1
 NtQueryObjectHook=0
@@ -123,7 +123,7 @@ NtQuerySystemInformationHook=1
 NtQuerySystemTimeHook=0
 NtSetContextThreadHook=0
 NtSetDebugFilterStateHook=0
-NtSetInformationThreadHook=0
+NtSetInformationThreadHook=1
 NtSetInformationProcessHook=0
 NtUserBlockInputHook=0
 NtUserBuildHwndListHook=1

diff --git a/HookLibrary/HookHelper.cpp b/HookLibrary/HookHelper.cpp
@@ -246,7 +246,7 @@ bool IsWow64Process(HANDLE ProcessHandle)
 	const NTSTATUS Status = NtQueryInformationProcess(ProcessHandle,
 													ProcessWow64Information,
 													&WoW64Peb,
-													sizeof(WoW64Peb),
+													sizeof(PPEB),
 													nullptr);
 
 	return NT_SUCCESS(Status) && WoW64Peb != nullptr;
@@ -276,7 +276,7 @@ InstallInstrumentationCallbackHook(
 		}
 
 		// WOW64: set the callback pointer in the version field
-		InstrumentationCallbackInfo.Version = (ULONG)(ULONG_PTR)Callback;
+		InstrumentationCallbackInfo.Version = (ULONG_PTR)Callback;
 #endif
 		InstrumentationCallbackInfo.Reserved = 0;
 		InstrumentationCallbackInfo.Callback = Callback;