Cryptographic Analysis of WIBU CodeMeter DLL

Independent security research on WIBU-Systems CodeMeter protection

Responsible Disclosure

• Vendor notified: December 24, 2025
• Disclosure period: 90 days
• Public release: March 24, 2026
• Scope: WibuBz32.dll analysis only

Summary

Analysis of WIBU CodeMeter runtime library reveals characteristics in custom PE sections inconsistent with AES-256 encryption.

Key Findings:

Methodology

1. Shannon Entropy

H(X) = -Σ P(xi) × log₂(P(xi))

Results:

• __wibu00: 6.48 bits/byte (vs 8.0 expected)
• __wibu01: 5.99 bits/byte
• __wibu02: 5.24 bits/byte

2. Frequency Analysis

Pattern 00000000 appears 20,294 times in 838KB.

• Expected (random): <100
• Chi-squared: p < 0.0001

3. XOR Detection

Probability with real AES: <10^-1000

Scope

Analyzed:

• WibuBz32.dll PE sections
• Statistical properties
• Entropy calculations

NOT Analyzed:

• Protected app data
• Runtime behavior
• Dongle protocols

Reproducibility

python entropy.py WibuBz32.dll
python xor_detect.py WibuBz32.dll
python patterns.py WibuBz32.dll

Status

Awaiting vendor response (90 days)

License: MIT
Version: 1.0
Date: Dec 24, 2025