VMProtect

Traditional software protectors have a common weakness, that they don’t modify the source code. The usual protection is based on “Envelope” principle, protectors adds some decrypt code at the end of application. When the protected software starts, protector’s loader gains the privilege first to decode encrypted sections in memory, and then transfers the rights to main program. Crackers have a chance to dump original application in memory and modify it using a series of tools. Besides, there are plenty of tutorials telling you how to unpack it on networks.

Unlike old software protection systems, VM protection can modify your source code. It can transform some code to bytecode, which is executed in a virtual machine.  Instructions architecture in virtual machine is completely different from standard x86 system. In theory, it’s very difficult for crackers to analyze the mutated code.

See the picture below, and you will find what is VM protection:

In general, virtual machine uses a brand new “language” to translate original code, this “language” is known only by our VM engine. Crackers will have a lot of trouble to understand this new “language” if they have not any reference. You will see that VM protection can effectively prevent code analysis, it is one of the most powerful protection systems. Unlike usual software protectors, VM engine can make the protection  system integrated with original application, it can not be separated, not to mention “Unpacking”.

How to use VM protection:

Zprotect offers several ways to use VM protection:

1. Use VM marker.

# include <stdio.h>

# include “ZprotectSDK.h”

void main()

{

ZProtect_VM_START      // VM Start Marker

printf(“Hello World”);

ZProtect_VM_END        // VM End Marker

}

2. Use Auto-VM.

You can use Pickup Functions on Code Protection panel to automatically deploy VM protection.