Page 1 of 1

x64 EP_Marker("vm_begin")

Posted: Tue May 19, 2015 9:15 am
by yoshke754
As I understand the way to do obfuscation to a code segment is using the virtual machine.
In C++ x64 the segment is marked by EP_Marker("vm_begin") and EP_Marker("vm_end").
I am protecting a dll (no exe) and having problems with these marks.
I am looking at the report of the Enigma Protector "Protection process log" window after the log line: "Process Virtual Machine"
ONE OF THE MARKED SEGMENTS IS OK, SOME SEGMENTS ARE SIMPLY IGNORED AND SOME PRODUCE ERROR:
"Markers error: the END marker is placed before BEGIN marker! All data will be ignored"
although the I have placed the 'begin' is before the 'end'.
The specific code that produce the error is like this:
EP_Marker("vm_begin"); // enigma ERROR end before begin ??
if(pMain)
{
g_vecMain.push_back(pMain) ;
iId = (int)g_vecMain.size() - 1 ;
pMain->DoSomething(iSomeParam) ;
}
EP_Marker("vm_end");

Maybe I am doing something totally wrong.
Do I have to set something in the Enigma Protector SETTINGS before running the protection ?

thanks.

Re: x64 EP_Marker("vm_begin")

Posted: Tue May 19, 2015 9:40 am
by Alec
Hi, you need to disable optimization for that particular code region because C++ optimizer cut's off your markers.

Re: x64 EP_Marker("vm_begin")

Posted: Tue May 19, 2015 1:28 pm
by yoshke754
Alec , thanks.
Now it looks OK.
I hope the obfuscation will be efficient.
Thanks.