Mac Advanced Protection Parameters

LOCKING_TYPE

Determines the type of Sentinel protection key to which the software can be locked. HL represents hardware keys. SL represents SL-AdminMode keys.

BACKGROUND_CHECK_AUTO_RELOGIN

If the Sentinel protection key periodic background check fails to detect a Sentinel protection key, the program attempts to log in to the key a second time before the user is informed that the key is missing.

MESSAGE_OUTPUT_MODE

Enables you to select how run-time user messages are provided. The following options are available:

>1 (windows) displays messages in a message box

> 2 (eventlog) includes events related to running the protected program in the Windows Administration Tools Event Viewer utility

>4 (stderr) displays messages to a user running Sentinel LDK Envelope from a command line

DYLIB_INIT_HASP_ERROR

Enables you to define the behavior when an error occurs when a dylib plug-in fails to initiate.

DYLIB_INIT_RETURN_VALUE

Enables you to define the value to be returned when a dylib plug-in initiates. (Only enabled when the value of DYLIB_INIT_HASP_ERROR is set to Return value.)

When the code size exceeds a certain size, the code is broken down at run-time and decrypted in the specified number of blocks.

>If 0 is specified, dump protection is disabled.

>If 1 is specified, all code is decrypted in one block.

> Higher values provide better protection, but result in a slower decryption process.

> Values greater than 15 significantly increase the decryption time without improving security.

If Envelope determines that you have assigned a value that is greater than appropriate (depending on the size of the code), it will automatically reduce the value as required.

Whether Envelope should remove the 64-bit versions inside the universal binary so that the binary will be compatible with the OS X 10.4.x (“Tiger”) operating system.

> True – Envelope removes the 64-bit versions inside the universal binary.

> False – Envelope does not remove the 64-bit versions inside the universal binary. However, a warning is written to the Envelope log that the application is not compatible with the Tiger operating system.

In a multi-thread application, if the Sentinel protection key periodic background check fails to detect a Sentinel protection key, all threads are (by default) suspended. When the key is detected again, the suspended threads are resumed. This parameter specifies which threads are suspended. Possible values are: •

>MACHOLDR_THREAD_ALL: All threads are suspended.

>MACHOLDR _THREAD_MAIN: Only the main thread is suspended.

> MACHOLDR _THREAD_NONE: No threads are suspended.

Warning: In certain situations, suspending only the main thread can cause damage to data or hardware. For example, when burning DVD media, suspending only the main thread can destroy the media.

It is possible to pass startup options to the kernel via NVRAM (non-volatile RAM). These flags can be set with a command line utility from terminal (this requires admin privileges).

Typically, these flags are intended for developers who work on kernel extensions, to enable some kernel-level debugging features. As a side effect, some protection techniques (like dump protection) can be easily bypassed when some of these kernel debugging features are enabled.

CHECK_KERNEL_DEBUGGER examines the currently-active kernel flags and compares them with the bit-mask created from the values of the flags that follow this parameter. If a match is found, the process is terminated to ensure that an attacker cannot analyze the protected application.

Usually the default settings assigned by Envelope are appropriate. However, in some instances, it might make sense to fine-tune or even disable this check (for example, for developer machines that work on kernel extensions that are part of the vendor software).

The descriptions of the kernel flags listed are beyond the scope of this help system.

In some applications, program code may be executed by external calls to Objective-C objects before the entry point has been executed. Therefore, the code is not yet decrypted, and the program crashes.

If OBJECTIVE-C OBFUSCATION is enabled, all information about the Objective-C code implemented in the application is hidden from the operating system. Therefore these external calls do not occur, as the application looks like it was not developed in Objective-C. All the Objective-C related information will be registered with the operating system during the Envelope runtime after decryption.

If the protected application crashes during startup, try enabling OBJECTIVE-C OBFUSCATION.

This option also offers some additional level of obfuscation, as static analysis will not show any Objective-C information.

In some instances, this feature is not compatible with the application. Therefore OBJECTIVE-C OBFUSCATION is disabled by default.