delphi VMProtectDecryptStringA memory clean?

Issues related to VMProtect
everymax1234
Posts: 3
Joined: Thu Oct 28, 2021 7:09 am

delphi VMProtectDecryptStringA memory clean?

Postby everymax1234 » Thu Oct 28, 2021 7:21 am

procedure TForm1.Button1Click(Sender: TObject);
var
nthookscript: Tstringlist;
begin
nthookscript:=nil;
nthookscript:=tstringlist.create;
nthookscript.add(VMProtectDecryptStringA(('teststring0000')));
nthookscript.add(VMProtectDecryptStringA(('teststring0001')));
nthookscript.add(VMProtectDecryptStringA(('teststring0002')));

nthookscript.clear;
nthookscript.free;
end;

teststring0000,teststring0001,teststring0002 -> memory data string delete!!

VMProtectFreeString?

Does using VMProtectFreeString in Delphi initialize memory?

How do I use it in my TStringList example?

I want to delete string data from memory

Admin
Site Admin
Posts: 2110
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: delphi VMProtectDecryptStringA memory clean?

Postby Admin » Thu Oct 28, 2021 7:36 am

Code: Select all

str1 = VMProtectDecryptStringA('teststring0000');
str2 = VMProtectDecryptStringA('teststring0001');
str3 = VMProtectDecryptStringA('teststring0002');
...
nthookscript:=tstringlist.create;
nthookscript.add(str1);
nthookscript.add(str2);
nthookscript.add(str3);

nthookscript.clear;
nthookscript.free;
...
VMProtectFreeString(str1);
VMProtectFreeString(str2);
VMProtectFreeString(str3);

everymax1234
Posts: 3
Joined: Thu Oct 28, 2021 7:09 am

Re: delphi VMProtectDecryptStringA memory clean?

Postby everymax1234 » Thu Oct 28, 2021 8:17 am

procedure TForm1.Button1Click(Sender: TObject);
var
nthookscript: Tstringlist;
str1 : string;
str2 : string;
str3 : string;
begin

showmessage('1');

str1 := VMProtectDecryptStringA('teststring0000');
str2 := VMProtectDecryptStringA('teststring0001');
str3 := VMProtectDecryptStringA('teststring0002');
nthookscript:=nil;
nthookscript:=tstringlist.create;

nthookscript.add(str1);
nthookscript.add(str2);
nthookscript.add(str3);

nthookscript.clear;
nthookscript.free;

showmessage('2');

VMProtectFreeString(@str1);
VMProtectFreeString(@str2);
VMProtectFreeString(@str3);

end;

https://i.ibb.co/dfmz40P/no-clean.png

Lazarus test.

Declare a variable and search the memory string after packing

Memory uninitialized after showmessge(2)

Admin
Site Admin
Posts: 2110
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:

Re: delphi VMProtectDecryptStringA memory clean?

Postby Admin » Thu Oct 28, 2021 8:41 am

Look at the declaration of VMProtectDecryptStringA more curefully:

Code: Select all

function VMProtectDecryptStringA(Value: PAnsiChar): PAnsiChar; {$IFDEF MSWINDOWS} stdcall {$ELSE} cdecl {$ENDIF};

It seems you don't know what differences between String and PAnsiChar. Here is the correct code:

Code: Select all

str1 : PAnsiChar;
str2 : PAnsiChar;
str3 : PAnsiChar;
...
VMProtectFreeString(str1);
VMProtectFreeString(str2);
VMProtectFreeString(str3);

everymax1234
Posts: 3
Joined: Thu Oct 28, 2021 7:09 am

Re: delphi VMProtectDecryptStringA memory clean?

Postby everymax1234 » Thu Oct 28, 2021 8:53 am

PAnsiChar -> memory clean success

thank you