Virtual Machine
Virtual Machine is a modern virtualization technology that allows to protect parts of the assembler sourse code of your module. Main idea of virtualization is converting original assembler code (which is well known for reverse engineers) to the PCODE - special programming language known only for Enigma Protector. When protected application requires to run virtualized code, the PCODE will be run on the internal Virtual Processor. Virtual Machine is very useful feature that allows to make reverse engineering/ analysing of the protected module very complex, our recommendation - using virtualization technology as much as possible. Also, note that not all code parts/functions should be virtualized. If the part of code or function executes too much times, it is not recommended to virtualize it, otherwise it slows down the work of your application and increase CPU loading. The better places for virtualization are parts of verifying registration code, trial control routines, cryptographic algorithms, in short, all the weak places that should not be reversed/cracked/analysed.
There are few ways the virtualization technology could be implemented:
- by means VM Markers. If you are software developer, have the sources code of your application and is able to compile it, then the VM Markers is the better and recommended way to apply virtualization;
- by using MAP file (MAP file - contains a list of functions with their addresses, it has same name as an input file choosen on Input Panel but have a .map extension. MAP file allows accurate analysing of the input file), selecting necessary functions. This is also a choice for software developers who are able to compile modules and generate MAP files. To learn more how to create MAP files for different development IDEs, see Making Of the Map File. Note, MAP file should be placed in the same folder with an input file and it should have same time span as an input file name. See Functions Selecting;
- third way, if you are not software developer and can't use two above methods then you may simply click Select Functions button and Enigma Protector will try to analyse the input file and find all functions that are possible to virtualize. Remember, this way is not so stable as a two previous, so you have double check workability of the protected modules. See Functions Selecting.
Limitations:
- Virtual Machine does not work with any kind of .NET files, either exe or dll files;
- if the part of code/functions selected for virtualization contains any Markers inside, the workability of the marker will be lost, the code inside marker will be just executed;
- for Delphi developers, the MAP file compiled with Delphi may contain a set of functions with the same names but different addresses. Enigma Protectors stores selected functions by the name in the project file. After loading of project file, the only first appeared function with necessary name will be selected;
Follow the links below for more information.
