Why wasn't an encrypted string removed from its original location?¶
When protected code references a string, Code Virtualizer stores an encrypted copy inside the protection code and redirects the protected reference to it. If no other code references the original string, Code Virtualizer overwrites its original location with zeros.
Compiler optimizations may store identical strings only once. If code outside the protected region also uses the string, Code Virtualizer must preserve the original copy.
Example¶
LRESULT CALLBACK MainHandler(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
switch (message)
{
case WM_INITDIALOG:
STR_ENCRYPT_START
printf("Hello World"); // "Hello World" string found and redirected the pointer inside "printf"
return TRUE;
STR_ENCRYPT_END
break;
case WM_COMMAND:
printf("Hello World"); // The "Hello World" string is referenced here again, from outside a STR_ENCRYPT marker
break;
}
return FALSE;
}
In this example, code outside the STR_ENCRYPT marker also references "Hello World", so Code Virtualizer cannot remove the original string. The protected region uses an encrypted copy, while the other code uses the original plaintext.
Even when a string appears to be used only once, it may be preserved because:
-
The compiler or linker created another pointer to the string, for example in a symbol table.
-
A code or data sequence happens to match the string's address, even though it is not a real reference.
If you are certain that no other code uses the string, add this option in the Advanced Options panel: