VMProtect 1.8

VMProtect 1.8 is a new generation of software protection. Protected parts of code are executed on the virtual machine, which makes it really difficult to analyze and crack the protected program. The built-in disassembler and using a MAP file will allow you to quickly select the necessary parts of the code protected against cracking.

What are protectors?

Protectors are programs used to protect software against cracking. Currently, there are a lot of protectors on the market, but nearly all of them have one considerable drawback - they do not modify the source code (software protection just means packing the entire file and it is the unpacker that finally unpacks the file that is "protected").

After the unpacker finishes its work, the program can be easily damped and finally it is possible to get the source (unpacked) files without any difficulties. Hackers have a lot of tools for disabling the most popular protectors. There are a lot of articles about nearly all protectors that tell you how to disable them that is why try to read what people from the underground write about a commercial protector in their articles before purchasing one.

A bit of theory

Major Features:

1. Mutation. The executed file is modified on the level of processor commands (existing commands are modified, all kinds of garbage commands are added, etc.). This compilation type poorly protects the code it processes against hacking and analyzing and mainly prevents functions being processed from determining with signature analyzers (PEiD+KANAL, IDA+FLIRT, etc.). As a rule, there is no need to protect library functions against hacking and analyzing and it will be enough just to change their signatures for the hacker to be unable to automatically determine what libraries you use in your applications (the level of protection against hacking and analyzing is low, the code execution rate is high).
2. Virtualization. Executable code is converted into bytecode executed by the virtual machine. This compilation type should be used for all critical parts of code where the execution rate is also important together with preventing hacking and analyzing (the level of protection against hacking and analyzing is medium, the code execution rate is medium).
3. Ultra (mutation + virtualization). The executable code is modified on the level of processor commands and after that it is converted into bytecode executed by the virtual machine. This compilation type should be used for all parts of code where the execution rate is not important (the level of protection against hacking and analyzing is high, the code execution rate is low).
   
4. Debug mode (determining external addresses). Applied to find addresses there are referenced to from "external" sections of code.
5. Hide constants. If this option is enabled, it will be impossible to find the addresses of variables or called functions in the open form.
6. Dynamic creation of online commands. The VM interpreter can execute not all Intel 8086 commands that is why such commands are executed in the form they were present in the code of the protected section. Creating online commands dynamically also makes it more difficult to crack bytecode.
7. Check the integrity of VM objects. While executing the program, the VM interpreter will automatically read the checksum of random sections in the interpreter, bytecode and watermarks that is used when commands are being performed. The integrity check of VM objects protects the interpreter, bytecode and watermarks against modifications.
8. Watermakrs. Select the watermark you want to embed into the protected file.
9. VM section name. You can specify the name of new sections the VM interpreter and bytecode for the interpreter will be written to.
10. Remove fixup elements (only for EXE files). Compilers (in particular, Delphi) create a list of fixup elements for EXE files. The operating system does not use these elements while loading EXE files. If you enable this option, VM will use the area occupied by the list of fixup elements for its needs.

 WareSeeker Editor