This question already has an answer here:
After handing on some crackmes using packed codes, I am now curious about
anti-dumping techniques. For the crackmes I have encoutered, my method is as follows: after the program unpacks itself, I take a memory snapshot (using IDA), then analysis the unpacked code (this approach has been proposed also by Igor in the answer of this question).
Since these crackmes are not sophisticated enough, this method works. But I am quite sure that there are more sophisticated techniques can bypass this method. The most detail document I can find is this article, however the discussed techiques are all about inserting (e.g. Nanomites) special codes into original ones or changing them completely (e.g. VMProtect, Code Virtualizer); or some other tricks to fool debuggers/disassemblers.
So my question is: are there existing techniques that prevent us from understanding the program by taking memory snapshot, while they do not change the original codes?
NB1. I have found a very close question and answer here