Windowed Decryption (Windows V3 Engine)

Sentinel LDK Envelope with the Windows V3 engine provides Windowed Decryption for native Windows applications and dynamic-link libraries (DLLs). Windowed Decryption hardens protected applications against static memory analysis and automated memory-dumping and reverse-engineering tools by decrypting protected code dynamically on demand during execution.

How Windowed Decryption Works

In traditional protection schemes, the entire executable code is decrypted in memory when the protected application starts. Consequently, a memory dump taken after initialization exposes the full, unprotected application binary in plaintext.

Windowed Decryption replaces full startup decryption with an on-demand, paging-based decryption architecture:

>On-Demand Decryption: Protected code remains encrypted in system memory until the execution pointer reaches a protected code section. Sentinel LDK Envelope intercepts page execution requests using Vectored Exception Handling (VEH) and dynamically decrypts the required code in multi-page chunks (by default, 4 pages at a time). This leverages code and cache locality to minimize exception overhead while keeping unexecuted code encrypted.

>Bounded Working Window: Plaintext code exposure is restricted to an active memory window. As application execution progresses and new pages are decrypted, older and inactive pages are evicted and re-encrypted (overwritten with non-executable bytes). This ensures that memory dumps captured at any moment during execution contain only a small, transient window of plaintext code.

>Adaptive Hot-Chunk Promotion: To maintain high execution speed, the Envelope runtime monitors decryption frequency per code chunk. When a code chunk exceeds a specific fault threshold (for example, code inside frequently executed code paths and loops or critical functions), the runtime automatically promotes that chunk to remain permanently in plaintext. This eliminates recurring exception dispatch overhead for hot execution paths while preserving on-demand protection for the rest of the application.

Key Advantages

>Hardened Reverse-Engineering Defense: Mitigates memory-dumping attacks and automated reverse-engineering tools by restricting plaintext memory exposure to an active working window (default: 64 pages). Inactive pages are evicted and re-encrypted (overwritten with non-executable bytes) as execution progresses.

>Optimized Steady-State Performance: Adaptive hot-chunk promotion ensures that computational performance remains close to native execution speed in intensive workloads.

Configuring Windowed Decryption

Windowed Decryption is enabled by default for all native Windows applications protected with the Windows V3 engine.

Enabling or Disabling in the Sentinel LDK Envelope GUI

To configure Windowed Decryption as a default setting:

1.In the Project pane, select Windows V3 under Default Protection Settings. (For details, see Windows (V3 Engine) Default Protection Settings Screen.)

2.Select or clear the Windowed Decryption check box.

To configure Windowed Decryption for an individual program:

1.In the Project pane, select your program under Programs. The Protection Details screen is displayed. (For details, see Defining Windows Protection Details (Windows V3 Engine).)

2.Select the Protection Settings tab. (For details, see Windows Protection Settings Screen.)

3.Select the Overwrite default protection settings check box.

4.Select or clear the Windowed Decryption check box.

Configuring in the Envelope Project File (.prjx)

You can configure Windowed Decryption directly in your Envelope project file (.prjx) using the WINDOWED_DECRYPTION parameter:

>To enable Windowed Decryption (default):

<WINDOWED_DECRYPTION>1</WINDOWED_DECRYPTION>

>To disable Windowed Decryption:

<WINDOWED_DECRYPTION>0</WINDOWED_DECRYPTION>

Existing project files created with earlier versions of Sentinel LDK open with Windowed Decryption enabled by default.

Using the Command-Line Tool (envelope.com)

When protecting applications using envelope.com, specify the project file that contains your desired configuration:

envelope.com -p MyProject.prjx

The command-line tool automatically applies the WINDOWED_DECRYPTION setting defined in the project file.

Platform Support and Compatibility

>Supported Platforms: Windowed Decryption supports 32-bit and 64-bit native Windows Portable Executable (PE) files, including executable files and dynamic-link libraries (DLLs), on Windows 10 and later.

>Interoperability: Windowed Decryption is compatible with AppOnChip, Envelope Plus, and Program Integrity Protection.

>Exception Handling: Host applications that implement custom unhandled exception handlers continue to function correctly when loading DLLs protected with Windowed Decryption.