Page 1 of 1

About Executed Processes feature.

Posted: Thu Oct 14, 2010 9:45 am
by Hamoude
I think it doesnt check for the Windows class or the Windows text, i have added a program into this feature to be executed whenever it started.

But when i changed the program file name, it didnt execute it., and it has the same Windows Class and Windows text.

Re: About Executed Processes feature.

Posted: Thu Oct 14, 2010 1:29 pm
by Enigma
Please also me sure that there is working AND rule for the file name/win text/win class. For example,
- if you check these 3 options for particular item, then Enigma will search the window/process that satisfies all these 3 criteria.
- if you want to see the process with any file name, but with only particular window text, then you have to add item to the Executed Process list and check only Window Text option for this item.

Does it make sense?

Re: About Executed Processes feature.

Posted: Thu Oct 14, 2010 3:03 pm
by Hamoude
I have tried everything.
I have added all the processes in enigma for the program i don't want it to start with my *.exe.
When i start my protected file, the program i have executed doesn't work.
If i changed the program name, it won't be executed, even i have checked the 3 features that [Execute process feature shows]

Re: About Executed Processes feature.

Posted: Thu Oct 14, 2010 3:13 pm
by Enigma
Hum.. seems I do not understand you exactly. You are trying to tell that there is a bug in Enigma, that protected file does not work if there is or no running he program included in Executed Processes checkup?

Just once again, to confirm how the Executed Process is working:
Example 1:
imagine you added the item to Executed Process list and you are checked all 3 items and there is following information:
Process Name "myprogram.exe" Window Text "OllyDbg*" Windows Class "ODBG_CLASS", then if the myprogram.exe is executed, then protected file not starts. But if you change myprogram.exe to myprogram11.exe then program will start, because since you use 3 criteria to check, then all these 3 criteria should happen.
Example 2:
imagine you added the item to Executed Process list and but checked only 2 items - Windows Text and Window Class check, this way, protected exe will not start even if you change the process name, because it does not check it.

Just to try, you may enable message warning for Executed Process, to check it out if the file does not start due to some executed process.

Re: About Executed Processes feature.

Posted: Thu Oct 14, 2010 3:32 pm
by Hamoude
Thanks Vlad, i got it :-)

Re: About Executed Processes feature.

Posted: Thu Oct 14, 2010 3:48 pm
by Enigma
Okk, glad it is solved :)