Enigma Protector

text removed

Hi Kenneth,

Firstly, please excuse me for the delay in reply! Now let's talk about your questions.

zylongaming wrote:We run a online game "BoutCheetah" (http://boutcheetah.zylongaming.com), and we have a few 'hackers' who like messing around with things. We have created a anti-hack shield called "ZylonShield" that gets injected into our game, and is packed inside of our games executable. However, the 'hackers' are able to disable functions of our anti-hack by memory editing the main packed executable. Would you be willing to check into my protected application, (I can send you the project, and unprotected files if you request them), and see if there is any way you can stop them from doing this, I have tried so many options, but it just doesn't seem to stop them.

Looks like it is a deal of all games. Gamers just edit the game memory to apply cheats. Can it be fixed or no, this depends on a game and methods gamers use to cheat.

The common advice there - using code virtualization. I.e. you should know, what addresses gamers patch. If it is an application code then you should apply virtual machine (code virtualization) to this code.

This is difficult to understand about what I'm talking if you do not have enough knowledges. I could give an example, but only in case if you know the address of memory that players patch.

zylongaming wrote: Another issue I am facing is, it takes around 10 seconds to fully launch our game. And, there seems to be some lag issues. There is no kind of issues like that when the game is unprotected.

This depends what version of Enigma Protector you are using. Next release will be working faster. If you would like, I can send you an intermediate version that is also working fast.

zylongaming wrote: Also, your hidden process scanner, can you give me a brief description on exactly how it works, (Does it terminate the program that is hidden, and my protected application, or just the actual hidden process?)

The process scanner in Enigma Protector just closes protected application if the process is found (or not found, depending on options).
I think you are talking about option "Terminate if hidden process found"? This option search all windows and related to this window application. If the window is found, but belonged application not found, then Enigma thinks that it is a hidden process.

zylongaming wrote: One more thing, everytime we release updates, I have to keep submitting false positives to like 10 anti-virus companies, and it takes them up to a week to fully undetect the process, what more can I do to prevent this?

Unfortunately, this happens sometimes. There are 3 main advices:
1. Looks like you are using the service like virustotal to check for a false detections? If so, you should be noted that all submitted samples there are being moving to antivirus developers, who usually, by default, mark file as suspicious (or just detect something inside it). Than more times you submit the sample there, than more false detections you will have. And detections will happen anyway, if you then submit false detection sample to antivirus companies or no.
This situation names as cascading false detection, it happens when one antivirus start to detect something in your file, and others, based on this detection, will find something too.
In short, I do not recommend to use virustotal at all.
2. You may obtain a digital certificate and sign protected files. Usually, this helps to fix many problems. There are many companies that offer digital certificates, one are cheaper, other more expensive. But really, there is no matter what one to use. You may use Comodo, Thawte or VeriSign for example.
3. As you may know, there is being developing special system for software protectors that will avoid false detections of protected files. This system is named "taggant system" and is handled by IEEE http://standards.ieee.org/news/2011/icsg_software.html We were promised many times about soon timeline of this project, but we still do not have it.. I very hope that soon we will finally get it and our customers will forget about false detetions.

text removed

Yes, the dll you are injecting can be protected and code virtualization can be applied to it.
Code virtualization could be applied using VM Markers, or using map file when you select the necessary functions for virtualization form the Virtual Machine - Functions Selecting panel.

Plugin dll for Enigma Protector also can be protected. So you may try it.

Will send new version to you soon.

text removed

No, code virtualization does not protect the strings. It works for code virtualization only.

Imagine, you are virtualizing some function. The function is a set of assembler instructions that are being run when program requires it. Using virtual machine (virtualization), this code is being deleted from the file/memory and translated to the special PCODE that is known to Enigma Protector only. When program attempts to execute this code, it is run on own virtual processor.
That's because virtual code is difficult to analyze.

To my mind, this is a good technique for a game protection against cheating as many game hoster complains.
There are 2 main problems that usually stops many people to use it:
1. find the proper address of the code that should be virtualized. Nothing I can help there.
2. add virtualization to Enigma Protector. As I advised, I can help there. If you give me addresses, I will show an example how to add a code virtualization.