Page 1 of 1
VMProtectIsValidImageCRC triggering
Posted: Wed Apr 07, 2010 3:36 am
by fatalerror
In my program VMProtectIsValidImageCRC is returning false after the file is protected sometimes changing some protection settings makes it work again. I don't know how to send you a sample since my program is a plug-in and on smaller test cases it is fine. Also in my plug-in initialization the function works correctly and doesn't trigger. This makes me the that the VMProtectIsValidImageCRC is working fine and that my plug-in is actually changing code what do you think can cause this? Would VMProtectDecryptStringA trigger this? I am changing a global array can this cause it? Or maybe VM is changing? I'm at a loss as to why it thinks the image has changed.
Re: VMProtectIsValidImageCRC triggering
Posted: Fri Apr 09, 2010 7:24 am
by Support
We need more information to reproduce the problem, so please send your plugin with all necessary information to
info@vmpsoft.com, so we can take a look.
Also you may try to disable all other plugins, so your one will run alone. If this fix the problem, it seems that other plugins may damage memory somehow.
Re: VMProtectIsValidImageCRC triggering
Posted: Fri Apr 09, 2010 9:04 am
by fatalerror
Thanks for your reply i will try your suggestion and get back to you.
Re: VMProtectIsValidImageCRC triggering
Posted: Sat May 08, 2010 10:05 am
by fatalerror
Its not feasible to send you my plugin but i have narrowed down the problem. On small samples it is fine but with my program its definitely VMDecryptStringA and only happens after the string has been accessed and only when the string protection level is set to mutation, with higher settings everything is fine. Any suggestions?
Re: VMProtectIsValidImageCRC triggering
Posted: Sun May 09, 2010 12:40 am
by fatalerror
I have successfully replicated the problem in a small sample. I sent you the sample with source code to your email it seems somehow Getting the serial state causes problems with mutated strings or something.
Re: VMProtectIsValidImageCRC triggering
Posted: Mon May 10, 2010 2:38 pm
by Admin
Please, check your e-mail.