Keyhole DRM/Armadillo 3.78 - 4.xx

[D-Jester]

First a big hello to ahmadmansoor, LaBBa, Shub-Nigurrath, JMI, hobferret, fly, hacnho, condzero, Ghandi, GPcH, Ricardo Narvaja, and anyone who I forgot.

I'm working on a Shockwave based game
Armadillo Standard Protection, IAT Emulation (No Debug-Blocker, Copymem II, No Nanomites)

Game.exe <- Armadillo 3.78 - 4.xx / Keyhole DRM
Launcher.exe <- Armadillo 3.78 - 4.xx

If you try to run Game.exe, you get the typical "Enter Code" dialog from Armadillo. The game won't run without that code, BUT if you run the Launcher, it will Createprocess and launch Game.exe

I cannot find how the two seperate processes are communicating nor how its launching Game.exe without an "Enter Key" dialog

I have found several interesting API Exports in Game.exe itself, but no calls are being made to them from Launcher.

Attaching to Game.exe after it has run seems futile after its loaded, other than for a dump for IDA to chew on.

I have been thinking of trying to code in on the fly a Copymem II style EBFE to get an infinite loop before attach. (Assembling DebugProcess, WriteProcessMemory, etc... instead of the CreateProcess)

I can't seem to get a working dump from Launcher.exe this Keyhole DRM is giving me a headache, is anyone familiar with this protection system?

Thoughts? Suggestions?