Protecting Windows Service Applications

Services are specific applications that (usually) run by system automatically, while startup, or by triggering of some event.

Example of services: HTTPD (Apache), MySql/MSSQL (most of other database providers). The list of locally installed services can be viewed by executing services.msc command.

Why Services are so specific?

Services are being run by the system in special environment, let’s say under special Windows user account. Since you can’t access applications running from another user session, you can’t manipulate graphical elements of these applications. This is the main and core specific of such applications!

If you ever tried DEMO version of Enigma Protector, you’ve seen that it adds a NAG splash screen to protected application (this is a limitation we added to DEMO version). NAG screen is a graphical element that requires user action (click on window) to close it. Due to service specifics we discussed above, you can’t access the dialog (it is just invisible for your user session), running protected with DEMO version service will always stay in memory, like running, but will never work, since execution is waiting you to close NAG screen.

Apart of the DEMO NAG screen, file protected with FULL licensed version of Enigma Protector may also show some dialogs and messages:

• • Registration Dialog – the option Registration Features – Registration Dialog can’t be used for such files.
    
    Instead, we recommend to make an another simple application that will be run under usual Windows user account, that will perform functions of registration only. So, steps would be the following:
    • create a new project for protecting of service, configure it with the required options and save, protect service;
    • copy the created project with another name, this copy will be used to protect a simple application, that will register the service. Create and protect some simple application, but in protection project you can enable Registration Features – Registration Dialog option, to allow user to enter license key etc. Protect this application (let’s name it as “Licensor”);
    • before installing and running protected service, end user has to run Licensor, enter the license key and register. Since we protected Licensor and service with the same project file, both will use same license keys. So if Licensor get’s registered, the service also gets registered.

    If there is no way to use additional Licensor application, the license key can be saved in Enigma Protector’s Keys Generator to file, which can be placed in the selected folder on the user’s computer to make service registered.

  • Splash Screen – since user never sees dialogs and windows created by a service, splash screen becomes absolutely useless option in this case. Should never be used.

• Protection Messages – there are many options in protection that allow to show a reminder message to user before termination. Such options should be unchecked. Example: Checkup – Anti-debugger – Show message before termination, Trial Control – Reminder, etc.

How to fix?

Above we gave recommendations how to avoid graphics for registration dialog, splash screen and how to disable messages. But there is an option that completely disables graphics, it is Miscellaneous – Other – Suppress graphical module (exists in licensed version only). This one is very suitable for services.

Apart of that, there is a plugins system in Enigma Protector that can handle all messages. Plugins SDK is located in the folder “EnigmaPluginSDK” of installed Enigma Protector. If you need to handle messages shown by protection in a service anyway, we recommend to create a plugin that will handle Enigma_Plugin_OnShowMessage function.

Before show any message, Enigma walks through all plugins and calls their Enigma_Plugin_OnShowMessage functions. If any of these functions return TRUE, the message from protection won’t be shown.

Using this trick you can handle all messages inside plugin and, if protection attempts to show any message, hook that and, eg, write a log information to a file. Read more about plugins usage at our Support Forum.

Other problems

Above we described how to avoid using of registration dialog for protected service with 2nd application (Licensor) that does a registration in user mode. However, there is some critical issue. Since we use two protected programs that accept license keys of each other, Licensor has to put the license key in the place where protected service will be able it to read.

For storing of license information there is Registration Features – Registration Data Storage panel. It allows to store licenses in File and/or in Registry.

So, what could be problems:

• Registry. The registry path HKEY_CURRENT_USER can’t be used because protected service and Licensor are being executed under different user accounts, so each file will access to own HKEY_CURRENT_USER registry key. HKEY_LOCAL_MACHINE is the correct place, but Licensor has to be executed with administrator privileges to write to this registry path. Protected service can read HKEY_LOCAL_MACHINE as well, no additional permissions are required for that;
• File. Same as for registry, file path should also be same for different user accounts:
  • DEFAULT FOLDER (the folder where application is run) – good way if Licensor and protected services are located in the same folder and this folder is not wrote protected for Licensor to put there license file;
  • SYSTEM, WINDOWS, PROGRAM FILES folder and so on, are write protected. If you wish the license key to be stored there, run Licensor with administrator privileges;
  • My Documents – this folder is user specific and so won’t work in this case;
  • All Users folders – good place and not write protected, so do not require admin privileges.

If you have questions, please write us back at support@enigmaprotector.com.