Markers vm_risc_begin & vm_risc_end

Post here messages if you have any problems with working of Enigma Protector
Post Reply
Posts: 5
Joined: Sat Feb 10, 2018 5:29 pm

Markers vm_risc_begin & vm_risc_end

Post by d3vsol » Sat Feb 10, 2018 5:44 pm

i wanted to protect my check via vm_risc_begin & vm_risc_end but some peoples could bypass it. can anyone explain me where i did the mistake.

here is the code:

Code: Select all

#include ""
	const char *HWID = EP_RegHardwareID();
	if (LicenseSerial == GetSerial(HWID))
		LicenseSerialCheck = true;
		LicenseSerialCheck = false;
	if (LicenseSerialCheck)
		_beginthread(Continue, 0, 0);
	} else {
	#include ""

Site Admin
Posts: 2477
Joined: Wed Aug 20, 2008 2:24 pm

Re: Markers vm_risc_begin & vm_risc_end

Post by Enigma » Mon Feb 12, 2018 10:52 am

Hi, I doubt the RISC VM was successfully reversed, I think in your case there are few other, more simple ways to break the chosen scheme. Try to investigate the advices I gave you to eliminate them:

1. I do not see that the procedure GetSerial() is protected in your case. Since you are using custom license scheme (that we do not recommend), your algorithm can be reversed and crackers could just generate keys for your software. Solution: protect GetSerial function too and I recommend to use MAP file for it's protection, instead of a marker.

2. This would be a huge problem in your case. Looks like the function GetSerial generates a required license key and then this one compares against the key entered by user (LicenseSerial), this is a mistake. Program should never behave so. The correct license key could exist in memory and cracker can just get it from memory. Enigma protects the code, but the memory or the stack. Best recommendation - use the license scheme provided by Enigma Protector, it is based on asymmetric crypt algorithms, so even if attacker knowns how the key is being generated, it is impossible to generate the same.

3. This also often happen. Imagine, you had a version #1 of your software without protection. Next you released version #2 and added this protection marker, but kept the code same. What can cracker do? Cracker won't analyze virtual machine, he just take the code of version 1 and replace it in version 2, so no cracking/unpacking skill are required. Solution: make changes to your algorithm, to the code, so it will be different than the code of the non protected version.

Please check all of these advices, all of them can be used to defeat the protection way you've chosen.

Post Reply