Hi johndoe,
Finally we tested your files.
The problem happen due to option Registration Features - Import Protection - Emulate WinAPI. And also use the latest version of Enigma Protector 3.70.
Why the problem happens? It is very specific. There is the following code in the injection program:
Code: Select all
ThreadHandle := CreateRemoteThread( hProcess , nil , 0, GetProcAddress(LoadLibrary('kernel32.dll'), 'LoadLibraryA') , LibName ,0 , TheadID );
Program gets an offset of the LoadLibraryA function and calls it in the remote process. Due to emulation of WinAPI, GetProcAddress returns not an address of LoadLibraryA in kernel32.dll but the address of emulated function inside protected process. Of course, this address does not exist or is invalid in the injected/remote process.
So if you disable this option for injection process, everything will be working well.
I tested both protected injector and protected injected dll, it worked well. I got a message from dll after injection.
Let me know if you will have any questions.