Functions Selecting

There is a list of function names selected for virtualization. Column Virtualization is editable to change the virtual machine type assigned to function. To change the list, click the Add Function(s) button. The below windows with the possibility to select functions should appear. Note that if you have a MAP/PDB file for the Input file, the list of functions will be shown, otherwise, Enigma will try to analyse the file itself and the functions names will be represented with their addresses. Take a look at the Creating a map file to learn now to create map file for different compilers.

Selection of Functions and Disassembler View

Select the function from the left list for virtualization. Right panel shows a disassembler view of the selected function. It is possible to walk through calls and jimps in the disassembler by double click on necessary assembler instruction.

If required function is not automatically found by Enigma Protector, it is possible to enter the function address to add a custom function to virtualization. At the top tab Custom Selection enter an address and click Disassemble button, Enigma Protector will try to recognize the function and add it to the list with Custom_ prefix. Custom function address should be in following format: example, 0x12345678 for hexadecimal address and 12345678 for decimal.

The type of virtual machine could be assigned for the selected function(s) through top tab Options.

To filter list of functions to find specific names, use the top tab Filter.