One day, a man came to my house and said "Would you like to buy these gongs
for $29?"

Spoiler: Context

Santa cosplayed witches say,

Here is one of the most over-protected synthesizer in the scene! It is now fully keygened except RSA2048 key is replaced to R2R one. (It's mathematically nearly impossible to factor the 2048bit keys - in 2022).

Unlike legit version, our release does not overwrite (hook) ZwProtectVirtualMemory in NTDLL.DLL, which is the MemoryProtect function of VMProtect. It will make more stabler than legit version.

----------------------------------

Why did it take so long? Because we are lazy witches! We had simpler crack which enable sharing legit licenses since V3 out. No one of us wanted to spend extra
time for the public release. Till. Now.

Merry Xmas, Check our extra protection note below for the fun!
Spoiler:
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
PROTECTiON NOTE - YEAH, YOU LiKE THiS!
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄

There are 4 parts in the protection.

[1] C&R Protection by Lennard
-----------------------------------------------------------------------------
This is the main protection. Classic Challenge & Response protection (or
Web Auth) using License File.

License File Structure for maniacs.

Size Usage
----- ----------------------------------------
0x004 Last 4 bytes of Config.xml magic value.
0x001 Current License Number.
0x001 Max License Number.
0x100 RSA2048 Encrypted Chunk.
0x100 Extra Protection Chunk.
0x004 CRC32 of (RSA2048 + Extra) Chunks.

After you activate, RSA2048 Chunk + Extra Chunk + CRC32 Chunk will be
copied to Config dir as "License.dat". Size = 0x100 + 0x100 + 0x04 = 0x204.


[2] Anti Search Encryption by Lennard
-----------------------------------------------------------------------------
Most of the auth contents are encrypted. If beginner crackers are trying to
search the memory, they can find nothing. Everytime content is needed, it
decrypts before using. There are many en/decryption algorithm made by him.
They are not strong cryptography but it's enough to stop beginner crackers.


[3] AntiDebugs and SYSCALL by Lennard
-----------------------------------------------------------------------------
Apart from the VMProtect, Lennard put many homemade antidebugs. One of the
interesting way is using SYSCALL instruction to detect debugger. We rarely
see SYSCALL in user application in 2022. SYSCALL is usually used in Win32API.
The behavior of SYSCALL is not documented by Microsoft. The argument
parameters for SYSCALL are different per Windows versions. If developer uses
SYSCALL, he needs to reverse certain Win32API and implement for every version
of Windows OS. When Windows has new update, application may stop working.

See how different SYSCALL values are.
https://j00ru.vexillium.org/syscalls/nt/64/


[4] VMProtect
-----------------------------------------------------------------------------
Yes, this is a main problem for crackers. Said to be one of the strongest
solution if it is used efficiently (but the fact is that many developers
dont!).

In Sylenth1 V3, following protection is performed :

- PE Protector : Code decryption at startup. All DLL calls are proxied.
Code modification will be detected at startup.

- Code obfuscation and virtualization : Code of authorization related stuff
is translated to un-disassemble-able one from Intel x86 or AMD64 opcodes.
This will kill any CPU optimization of compiler.

- Memory Protection : To block the memory attack from the hacker, VMProtect
overwrites and hooks ZwProtectVirtualMemory in NTDLL.DLL (very important
system DLL). After that, typical Win32API like VirtualProtect will be
controlled by VMProtect. Of course, this behavior is incompatible with
any other plugins doing the same hooking approach. When it happens,
application may crash when ZwProtectVirtualMemory is called.


The VMProtect usage in Sylenth1 is enough efficient (unlike some others lol).
But that is an aspect of anti-piracy. The protection behavior do has serious
side effect. Especially, hooking NTDLL is obviously crazy for 1 audio plugin.

Example of API hooking crash syndrome by overdoing protections:

https://vi-control.net/community/threads/make-my-own-cubase-ilok.81969/
https://www.kvraudio.com/forum/viewtopic.php?t=465317&start=15
https://www.kvraudio.com/forum/viewtopic.php?t=442754

NOTE : PACE already deprecated hooking CreateThread 5+ years ago.

While VMProtect has good reputation to protect the software, it is not made
for plugin system, which one EXE loads tons of DLL made by many developers.
It is not possible for VMProtect to offer their best protections while
keeping the compatibility and stability.


Summary : What R2R think
-----------------------------------------------------------------------------
There are many homemade protections inside Sylenth1. It is also VMProtect-ed.
However, an experienced cracker who can attack to VMProtect will not be
bothered by those homemade protection. Considering that those homemade ones
have lots of side effects for performance, developing, compatibility
(especially the SYSCALL), there are no good reasons to do that. It is not
year 2005. Lennard seriously needs to update his knowledge to catch up.

Using VMProtect is OK. His choice. But hooking NTDLL.DLL is not acceptable.
Because Mac is now ARM based, and VMProtect supports Intel CPU only, we
don't think VMProtect is a good choice for protecting Win/Mac hybrid audio
applications in 2022, especially after we made keygen for all part except
RSA2048. Nothing need to be obfuscated or virtualized anymore

Next Scenario : Fastidious legit users start using R2R version because it
has less issue caused by DRM.


Time Waste Table for Cracking Sylenth1
-----------------------------------------------------------------------------
0.5 (Man-Day) for checking protection.
1.0 for cracking protection in the debugger.
1.0 for coding sweet tools for VST/VST3/AAX.
0.5 for coding keygen.
1.0 for final testing and fixing for extra checks

About 30 Man-Hours. Ask Lennard whether it's shorter or longer than he
expected.


Is Xmas over?
-----------------------------------------------------------------------------
"Yes it is." A witch said, and she explained they spent expensive shipping
expenses to deliver Syntronik2 library this year. They didn't have enough
money to hire more sexy santa witches.

One day, a man came to my house and said "Would you like to buy these gongs
for $29?"

 

Last edited: Dec 18, 2022

That's a steal. I can't find any percussion library at that price

 

R2R clearly specified that Xmas is over. As for some speculation regarding the gongs, assuming they are actually connected to this, many companies have the famous 29 as a price. And almost all PA plugins can be purchased between 12.99 and 19.99. They also gave away a lot of super products this year, including Focusrite console and Shadow Hills MC.

 

"NO" said the man at the door, you are in struggle with the enemy of my enemy and this does not make you a friend at any price. Be off with you now before my real friend here visiting our loving family hexes thee! SWAHA. At that, a low rumbling emanating from high in the sky could more be felt rather than aurally heard. As it slowly rose in pitch the shyster was able to define the direction from which it came and cowered in fear at the realization. It was the sun itself, it's very light a vector for the path of the resonance that could easily destroy him, counteract his rancid and fetid vibration and banish him from life giving light itself. The shyster ran in fear into the deep, dark labyrinth of a cave at the outskirts of this small Japanese fishing village...he has not been seen since that very day.

 

Last edited: Dec 18, 2022

but they didn't say anything about the New Year right ?

 

Bored Week end?
Pop corn time...

 

Technically yes, they only mentioned Xmas. But I can't honestly tell you if Xmas and NYE releases mean the same thing. I hope not

 

ah, the MEGA gong finally here

 

"Your "Forever $29" coupons are here!"

 

fucking hell... my original comment was "waiting for Plugin Alliance". then I edited it because I thought I might have written something stupid

and now what we see...

 

R2R you bloody motherfuckers. You got us all.

 

Ok guys, that was fun, but, too much request here. Thread closed.