Themida allows you to insert custom plugins (DLLs) that will be embedded inside the protected binary. The embedded plugin can implement specific defined callbacks that will be called when a specific protection event occurs, so you can have more control on the protection, add your own custom protections, etc.
A plugin is basically a compiled native DLL (.NET DLLs are not supported), that exports specific functions names that matches a specific name pattern. For example, the callback "*SecureEngineInitialize*" (notice the wildcard) means that you can define any function (to export) that will contain the "SecureEngineInitialize" string within your function name. For example, the function name MyPlugin_SecureEngineInitialize will match the "*SecureEngineInitialize*" callback.
Options
•Perform process hooking: This option will fully emulate the loading of your DLL in memory. This option is only required for specific plugins. Most plugins will work fine without this option. The preferred is to have this option unchecked, because it won't perform any hooking on the current process.
Testing your plugins
It's a good idea to test your plugins after your modify them, just to make sure that the calling convention (stdcall) and parameters are defined as expected. To test your plugin, you can just right-click on it and select "Test Plugin". Your defined callbacks will be called with default/dummy parameters to test your callbacks. If a callback fails (produces exception, etc) it will be reported on the User Interface.
Supported Compilers
There are no restrictions about the compiler used to create a plugin. The only requirement is that the plugin cannot be a .NET (or mixed managed) DLL. Only native DLLs are supported.
In case that you are using Visual Studio to create your plugin, you should avoid the explicit linking with the Microsoft Runtime Libraries (such as MSVCR100, etc.). You should compile your DLL with the /MT compiler switch.
Plugin Callbacks
The plugin system will be extended in future versions with new callbacks. The current defined callbacks (name patterns) are:
•SecureEngineShowCustomMessage