Why does IsValidImageCRC return false some PC?

VMProtect
1

It seems that some PCs are returning a false result when running IsValidImageCRC(), which is packed in the version 3.5.0.
We’ve reviewed the system information from these cases but haven’t identified any other issues.
Interestingly, previous versions of our software do not encounter this problem on the same PCs.

  • It was packed under the old version of VMProtect(2.x)

How can we resolve this?

2

Your file was changed on HDD/in the memory, so IsValidImageCRC returns “false”.

3

I must disagree with your comment.

Our software is currently packed with VMProtect 3.5. However, I’d like to point out the following:

  • Intriguingly, earlier versions of our software, which were packed with VMProtect 2.x, did not encounter this issue on the same PCs.

In addition,

  • Another version of our software, also packed with VMProtect 3.5, did not encounter any issues on the same PC.

Could the problem be with VMProtect version 2.x or 3.5?

How can we resolve this?

4

.NET + Windows 7?

5

Windows 7 or higher.
Our s/w don’t use .NET

We were reported this problem from some users.

6

Could you give us any other advise ?

Some of our users are using old versions of our software, they feel very inconvenient, us too

7

Try to find the reason of this problem by yourself (make dump of your application from the memory and compare it with original image from the file - any differences except relocations and IAT will show the problem).

8

We tested some cases.

We make some test packages

  • remove all manual virtualize
  • remove all function virtualize.
  • Main option:
    File:
    Memory protection No
    Import Protection No
    Resource Protection No
    Pack the Output File No

Detection
Debugger User-mode + Kernal-mode
Virtualize Tools : No

Additional
Strip Debug Information No
Strip Relocation(for Exe file only) No


One of case, Our program show CRC error message, Win11(Korean version), running Windows Defender(without another Antivirus software)

  • Only korean version has the problem.

However, Our software ran successfully after the user installed “Avast Free” .

We suspect there may be a compatibility issue between Windows Defender and VMProtect.