Hey,
I am using the Demo of Enigma at the moment so far enjoying it, However I am seeing that the checkup Anti-Debugger and Inline patching don't seem to do much to stop DLL injection and patching ?
just as a crude test I am running my program and attaching to it using CE 7.5 set to the VEH debugger method (VEH injects into the process and always CE to debug as normal).
This is kind of a big issue for me as at the moment people are injecting a dll into my process to patch my auth system :/
Please let me know if i am maybe missing something here, would love to get this resolved and use Enigma full time.
Blocking patching/DLL injection
Re: Blocking patching/DLL injection
Hi,
As for dll injection - please note, Windows is working such way that it is not possible to protect any application against of reading/writing it's memory, injection of any code or so.
You need to protect not against dll injection, but against the actions that this injected dll does. For example, usually, injected dll changes application memory, change bytecode, so the execution of main programs goes such way the cracker wants. So you need to control this memory region against manipulations, for example, by moving it to another place, or adding it to virtual machine in Enigma Protector.
This is the most correct way to protect against dll injection.
As for dll injection - please note, Windows is working such way that it is not possible to protect any application against of reading/writing it's memory, injection of any code or so.
You need to protect not against dll injection, but against the actions that this injected dll does. For example, usually, injected dll changes application memory, change bytecode, so the execution of main programs goes such way the cracker wants. So you need to control this memory region against manipulations, for example, by moving it to another place, or adding it to virtual machine in Enigma Protector.
This is the most correct way to protect against dll injection.