Virtual Machine is a modern virtualization technology that allows you to protect parts of the assembler source code of your module. The main idea of virtualization is converting the original assembler code (which is well-known to reverse engineers) to the PCODE - a special programming language known only to the Enigma Protector. When a protected application requires to run a virtualized code, the PCODE will be run on the internal Virtual Processor. Virtual Machine is a very useful feature that allows you to make reverse engineering/ analysing of the protected module very complex. Our recommendation is to use the virtualization technology as often as possible. Also, note that not all code parts/functions should be virtualized. If the part of the code or function is executed too many times, it is not recommended to virtualize it, otherwise it will slow down the work of your application and increase CPU loading. The best places for virtualization are parts of verifying registration code, trial control routines, cryptographic algorithms, in short, all weak places that should not be reversed/cracked/analysed.
There are several ways the virtualization technology could be implemented:
- by means of VM Markers. If you are a software developer, have the sources code of your application and can compile it, the best and most recommended way to apply virtualization is the VM Markers;
- by using a MAP file (the MAP file contains a list of functions with their addresses, it has the same name as an input file choosen on Input Panel but has a .map extension. A MAP file allows accurate analysing of the input file), selecting the necessary functions. This is also a solution for software developers who can compile modules and generate MAP files. To learn more about the creation of MAP files for different development IDEs, see Making Of the Map File. Note that a MAP file should be placed in the same folder as an input file and it should have the same time span as the input file name. See Functions Selecting;
- the third way, if you are not a software developer and cannot use the above two methods, you may simply click the Select Functions button and The Enigma Protector will try to analyse the input file and find all functions that are possible to be virtualized. Remember, this option is not so stable as the previous ones, so you have to make a double check of workability of the protected modules. See Functions Selecting.
- Virtual Machine does not work with any kind of .NET files, either exe or dll files;
- if the part of code/functions selected for virtualization contains any Markers inside, the workability of the marker will be lost, the code inside the marker will only be executed;
- for Delphi developers, the MAP file compiled with Delphi may contain a set of functions with the same names but different addresses. The Enigma Protector stores the selected functions by the name in the project file. After loading the project file, only the function with necessary name that appeared first will be selected;
Follow the links below for more information.