Methods of detecting dongle emulator
 

In previous version of HaspAPI (earlier realisation of their VM) iceman (general developer of Aladdin protection) checks match of value of offset PM_API, V86_API, and DeviceIoControl routines. If match, API will continue their work, if not...

Very interesting that API of protected program relocates by hidden interface of HASP Driver from Ring3 to Ring0. In attach i've put example how to use this.

But dongle driver replacing technology is very inconvient, now filter driver technology used in emulating dongle. Very useful to check specific strings at Registry, such as "System\CurrentControlSet\Services\Emulator\HASP" and "Software\HaspEmulPE", but this way is not true detection of emulator.

Can anyone tell me true way for detecting filter drivers?

It crashes my pc :(

bye

I found 2 IDs on my machine;-)

You need to install HASP dongle drivers. From v3.81 and till current release HASP driver allow to jump from ring3 to ring0, it's potentially dangerious.

thx MeteO

i didnt realized that i dont have it installed...


bye