Page 1 of 1

Virtual Machine and C++ on Enigma 1.64

Posted: Tue Mar 03, 2009 5:41 pm
by iaanus
With the new modification in release 1.64 I've been able to use the virtual machine with my C++ project. The feature seems to work fine. Actually I am not able to determine how "strong" it protects, but I trust it does ;-). There are a couple of things that may be done to further improve the feature:

1) The new "undecoration" feature undecorates too much. Currently, Enigma seems to be displaying all characters from the initial "?" up to the first "@". Unfortunately if I have two classes ClassA and ClassB and both have a member function named func, the two symbols will start with ?func@ClassA@@... and ?func@ClassB@@... This means that in Enigma I will see "func" twice and there's no way to determine which func is in ClassA and which is in ClassB. I definetely suggest to use UnDecorateSymbolName with an 0xffff flag instead of using custom-written code. Symbols starting with "??" (which are not undecorated by UnDecorateSymbolName) can safely be ignored. Please notice that undecorated symbols produced by UnDecorateSymbolName can be extremely long (in my project I have a 1377-char symbol) but there's nothing we can do about that.

2) Enigma saves in the project file the undecorated name and the address of each symbol: both information are totally useless. The address might change after a recompilation, while the undecorated name is not enough to detect the correct symbol in case of duplicates (as shown above). Because of this limitations, the only way to use the VM is to open the Enigma project and re-select the correct functions each time you protect the executable. This is very inconvenient, especially when you use Enigma in a batch file from the command line (as I usually do). I suggest to write the decorated symbol in the project file. Moroever it could also be useful to have Enigma display a warning if a symbol in the project is not found in the map (useful to detect subtle changes in the decorated name, for example a change in the return value or the number of parameters).

Just my opinion,

Re: Virtual Machine and C++ on Enigma 1.64

Posted: Wed Mar 04, 2009 9:55 am
by Enigma
It really protects very good :) Believe me!
1) The new "undecoration" feature undecorates too much. Currently, Enigma seems to be displaying all characters from the initial "?" up to the first "@". Unfortunately if I have two classes ClassA and ClassB and both have a member function named func, the two symbols will start with ?func@ClassA@@... and ?func@ClassB@@... This means that in Enigma I will see "func" twice and there's no way to determine which func is in ClassA and which is in ClassB. I definetely suggest to use UnDecorateSymbolName with an 0xffff flag instead of using custom-written code. Symbols starting with "??" (which are not undecorated by UnDecorateSymbolName) can safely be ignored. Please notice that undecorated symbols produced by UnDecorateSymbolName can be extremely long (in my project I have a 1377-char symbol) but there's nothing we can do about that.
Yes, let explain me how it works: Enigma is looking for the first "letter" symbols in the string (it is start if the function name) and adds all the symbols until next illegal (for example @ sumbol). Ok, I understand that it maybe not so useful, but it is more useful then full long names.
Regarding UnDecorateSymbolName, yes, I remember, you wrote about this, just I worry that this function is not supported of all the Windows, as written in MSDN is requires "DbgHelp.dll 5.1 or later". Anyway, I will test this function out (may be will try to make the same functionality as this function). The second thing about I worry is that Virtual Machine may use Delphi compiled map files, but Delphi's map file does not require names undecorating.
2) Enigma saves in the project file the undecorated name and the address of each symbol: both information are totally useless. The address might change after a recompilation, while the undecorated name is not enough to detect the correct symbol in case of duplicates (as shown above). Because of this limitations, the only way to use the VM is to open the Enigma project and re-select the correct functions each time you protect the executable. This is very inconvenient, especially when you use Enigma in a batch file from the command line (as I usually do). I suggest to write the decorated symbol in the project file. Moroever it could also be useful to have Enigma display a warning if a symbol in the project is not found in the map (useful to detect subtle changes in the decorated name, for example a change in the return value or the number of parameters).
There are problems too. C++ map files (MAYBE, I'm not sure), do not contain dublicates names (so, your advice maybe helpful), BUT, Delphi compiled map files may contain a lot of duplicated names (with the different addresses), so I decided to use compromise desicion. Finally, this is endless discussion, if I make improvements for C++ then it will be disadvantahe for Delphi and vice versa.

To my mind, protection should not be fully automated and seems it is not such difficult to open Enigma one time per each release and configure protection...
Anyway, thanks you for the suggestions, I will try to make this more and more useful!

Re: Virtual Machine and C++ on Enigma 1.64

Posted: Wed Mar 04, 2009 3:37 pm
by iaanus
Enigma wrote:Yes, let explain me how it works: Enigma is looking for the first "letter" symbols in the string (it is start if the function name) and adds all the symbols until next illegal (for example @ sumbol). Ok, I understand that it maybe not so useful, but it is more useful then full long names.
I disagree. When you use C++ classes and namespaces, having just the function name is nearly useless.
Enigma wrote:Regarding UnDecorateSymbolName, yes, I remember, you wrote about this, just I worry that this function is not supported of all the Windows, as written in MSDN is requires "DbgHelp.dll 5.1 or later". Anyway, I will test this function out (may be will try to make the same functionality as this function). The second thing about I worry is that Virtual Machine may use Delphi compiled map files, but Delphi's map file does not require names undecorating.
I see. If you are going to write your own undecorator (which may not be that difficult, after all) please consider having at least all classes and namespaces in the resulting symbol. Function parameters (useful to select among overloads) are less important, you can leave them out. Same from template parameters, but just because it's rarely useful to protect a template function.

You may find this page a good starting point.
Enigma wrote:
2) Enigma saves in the project file the undecorated name and the address of each symbol: both information are totally useless. The address might change after a recompilation, while the undecorated name is not enough to detect the correct symbol in case of duplicates (as shown above). Because of this limitations, the only way to use the VM is to open the Enigma project and re-select the correct functions each time you protect the executable. This is very inconvenient, especially when you use Enigma in a batch file from the command line (as I usually do). I suggest to write the decorated symbol in the project file. Moroever it could also be useful to have Enigma display a warning if a symbol in the project is not found in the map (useful to detect subtle changes in the decorated name, for example a change in the return value or the number of parameters).
There are problems too. C++ map files (MAYBE, I'm not sure), do not contain dublicates names (so, your advice maybe helpful), BUT, Delphi compiled map files may contain a lot of duplicated names (with the different addresses), so I decided to use compromise desicion. Finally, this is endless discussion, if I make improvements for C++ then it will be disadvantahe for Delphi and vice versa.
I don't know Delphi, but it's hard for me to swallow that a map file can have duplicate names in it. Anyway, C++ symbols are easily recognizable because they always start with "?", so you might decide to write the full symbol whenever you see the "?" prefix and follow the "standard" approach (whatever that is) when you don't.
Enigma wrote:To my mind, protection should not be fully automated and seems it is not such difficult to open Enigma one time per each release and configure protection...
I beg to differ. Fully automating the whole building process is a strict requirement for me. It's not a matter of being "difficult". The difference is between requiring a human being and not requiring one, and it may make a big difference on some projects.

Re: Virtual Machine and C++ on Enigma 1.64

Posted: Thu Mar 05, 2009 1:52 pm
by Enigma
Thanks iaanus for the information! Ok, I will review logic of Virtual Machine, will try to make it more helpful!

Re: Virtual Machine and C++ on Enigma 1.64

Posted: Thu Apr 30, 2009 6:14 am
by Enigma
iaanus, just let you know, you were right regarding functions undecorating for Virtual Machine, I embed UnDecorateSymbolName, next release will have this feature, really, after this functions functions names are looking much better :) Thanks!