Enhancing Protection with Windowed Decryption

Sentinel LDK Envelope with the Windows V3 engine provides Windowed Decryption, an advanced memory-protection capability that protects native Windows applications and dynamic-link libraries (DLLs) against memory dumping, reverse engineering, and automated analysis.

Traditional protection decrypts all protected code sections into physical memory at process startup. After initialization completes, an attacker or automated tool can capture a memory dump containing the entire decrypted program image. Windowed Decryption mitigates this risk by decrypting code dynamically on demand as execution proceeds.

When you protect an application with Windowed Decryption enabled, the protected code remains encrypted in memory. Sentinel LDK Envelope enforces security and performance through the following architecture:

>On-Demand Decryption: Protected code remains encrypted in system memory until the execution pointer reaches a protected code section. Sentinel LDK Envelope intercepts page execution requests using Vectored Exception Handling (VEH) and dynamically decrypts the required code in multi-page chunks (by default, 4 pages at a time). This leverages code and cache locality to minimize exception overhead while keeping unexecuted code encrypted.

>Bounded Working Window: Plaintext code exposure is restricted to an active memory window. As application execution progresses and new pages are decrypted, older and inactive pages are evicted and re-encrypted (overwritten with non-executable bytes). This ensures that memory dumps captured at any moment during execution contain only a small, transient window of plaintext code.

>Adaptive Hot-Chunk Promotion: To maintain high execution speed, the Envelope runtime monitors decryption frequency per code chunk. When a code chunk exceeds a specific fault threshold (for example, code inside frequently executed code paths and loops or critical functions), the runtime automatically promotes that chunk to remain permanently in plaintext. This eliminates recurring exception dispatch overhead for hot execution paths while preserving on-demand protection for the rest of the application.

For more information, see Sentinel LDK Envelope for Windows.