Instead of emulating the whole VM, advanced bypassers use . They set a breakpoint on the GetCurrentHwid function inside the VM. When the VM throws an exception because of the breakpoint, the VEH catches it and manually pushes the correct HWID onto the stack.
For modern versions of Enigma that bypass user-mode APIs and query the hardware directly, user-mode hooking fails. This is where kernel-mode spoofers come into play. enigma protector hwid bypass better
Analysis of Enigma Protector HWID Locking Mechanisms (Educational Purpose Only) Instead of emulating the whole VM, advanced bypassers use