Enigma Protector

Hello everyone,

I started using Enigma Protector three days ago and I have to say that it is an excellent tool for application protection.
Unfortunately, I have a problem which I can not explain or fix. This problem crashes my application all the time.

During application start-up, if my application is registered I call the function EP_RegKeyInformation() to get the licence information. The expiration date is always correct, but the sections always wrong. When I generate the licence I define "Section1" for decryption, but the array TKeyInformation.EncryptedSections[16] has the value "true" at the elements 4,5,6,7.
The above two are the least important problems. The most important problem is that when the scope that calls EP_RegKeyInformation() is lost, my application crashes! I.e.: If EP_RegKeyInformation() is called from a function "checkLicence()", then when the checkLicence() function returns, the application crashes.

Here is a very simple example that recreates the problem/crash: http://pastebin.com/brPfp3C0

When I run the application I get the following error: Run-Time Check Failure #2 - Stack around the variable 'lName' was corrupted.
And if I run the executable using the visual studio debugger I get several of these errors:
First-chance exception at 0x013a6ab9 in EnigmaTest01_protected.exe: 0xC0000094: Integer division by zero.
First-chance exception at 0x013a6ae4 in EnigmaTest01_protected.exe: 0xC000001D: Illegal Instruction.

I really don't know what I am doing wrong. Could someone help me please? I have Enigma version 3.6 and I am using Visual Studio 2008 SP1. The build target of my project is Win32 and my OS is Windows 7 SP1 x64.

Thanks a lot for your time!

Cheers,
Bekos

Hi Bekos,

I believe the problem is very simple. Due to incorrect alignment of the TKeyInformation you get incorrect results. And then, due to difference of the structure size that you pass to the protection and the one that protection fills out the file crashes.

This is problem of SDK that will be solved in next version.

You can fix it very easy. In the enigma_ide.h, at the top, add a line and at the module end: Please let me know if it solves the problem.

Hello Enigma,

I tried to add #pragma pack(push,1) at the top of enigma_ide.h and #pragma pack(pop) at the end of enigma_ide.h but the problem is still there. In addition, now all the TKeyInformation.EncryptedSections[16] elements are set to false and the date variables are set to some invalid values (big numbers). Does this code crash on your machine too? Maybe I am misusing the API?
Thanks a lot!

Cheers,
Bekos

No, there is no misuse of API, you are doing it exactly right way!

I'm still sure there is just structures sizes difference. Everything shows that there is such problem.

Enigma Protector missed C++ example for EP_RegKeyInformation, I just created such example and tested - everything is working well there, function returns correct data and no crash.

Can you please check the size of the TKeyInformation structure? Correct size is 0xAC, 172 bytes. What is the size in your case? Check what value this code returns:

Hello Enigma,

WITH the "#pragma push/pop" the result of sizeof(TKeyInformation) is 94 bytes.
WITHOUT the "#pragma push/pop" the result of sizeof(TKeyInformation) is 120 bytes.

Lets ignore the second one (which is wrong for sure), and focus on the second one. On my compiler sizeof(bool) returns 1 and sizeof(DWORD) returns 4.
The TKeyInformation struct has 26 bools and 17 DWORDs: (26x1) + (17x4) = 94bytes
Your 172 can also be justified if the bools are 4bytes in your platform. According to the C++ standard, size of bool is platform/implementation dependent.

Do you think that this might cause a problem? Although it shouldn't be a problem if you are using sizeof()s and you are not hardcoding the size anywhere. Do you have the size "172" hardcoded somewhere inside the enigma library? Maybe you are using "BOOL" instead of bool somewhere inside the library? (The BOOL is a typedef of long int if I am not mistaken).

To be honest, I still believe that I am doing something wrong, because no one else has this problem.. Is it possible that some setting in the enigma project is causing this?

Thank you very much for your help!

Cheers,
Bekos

Hi Bekos,

Unfortunately I did not notice you are trying version 3.60. In the latest 3.70 version this problem is solved.

There is no need to place push/pop, as you correctly noticed, problem is with the bool type. It has to be BOOL instead of just bool.

BOOL is 4 bytes size, so 26 BOOLs and 17 DWORDs: (26x4) + (17x4) = 172 bytes, it gives us exactly correct size of structure.

I've attached correct header file.

Sorry for misunderstanding.

Heya Enigma,

Thanks so much for your answer! Now everything makes sense. I will try the new version as soon as I find some free time.

Thanks again!

That's good, let me know if you will have any other problems/questions!

I finally found some free time to test it and everything works great.
Thanks a lot Enigma!

Cheers,
Bekos

PS: I just have to mention that you accidentally added semicolons ';' after the #pragma push/pop. As a result, visual studio 2008 generates some warnings.

Bekos wrote: PS: I just have to mention that you accidentally added semicolons ';' after the #pragma push/pop. As a result, visual studio 2008 generates some warnings.

Yes, that's correct, thanks you!

Moreover, #pragma (push, 1) is little useless there, it does not make sense and can be eliminated at all.