I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find many comparisons. They are all in a similar price range so that is not a huge problem. I was wondering what the main differences are between them? Virtualization, string encryption, packing etc. I couldn't find much info about that.
All replies are appreciated! Thanks
Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.
This comparison will only include the protectors I personally have a licence for: VMProtect and Themida. I do not have a licence to Enigma, so I cannot tell about its protection features.
I will also not be including the licencing features of either, I will only be talking about the protection methods they employ.
To get us started, here is the "unprotected" version of a simple loop function that we will be protecting with both protectors to see what they output.
VMProtect
VMProtect has 3 protection modes: Mutation, Virtualization, and "Ultra" (both methods combined)
Mutation does what it says it does: it mutates the assembly code to make automated analysis of it harder. The resulting mutated code varies drastically per compilation.
On the other hand, Virtualization translates the code into a special format that only a special virtual machine can run. It then inserts a "stub" function to call the VM where the actual code was supposed to be ran.
Note that this VM inserts a lot of overhead. The original ~100kb application was increased to around ~600kb after protection using this method. You can decrease the size though by turning on the packing feature inside of VMProtect.
There is also functionality for checking if debuggers are being ran, string encryption, methods of grabbing a unique identifier for the computers hardware, etc.
Themida
Themida is a little different from VMP. While it also has the same protection features of VMP, it does it much differently and has a few more features that VMP does not have. Note though that these features that VMP does not have do not work on all application types.
For Themida's Mutation, it does it quite differently to VMP. It adds lots of random operations to the assembly instead of specifically mutating each opcode.
Themida's Virtualization however has one cool feature that VMP does not: Multiple VM architectures. Themida has the ability to have different virtual machines (using a different architecture) inside of the same application. There is also different 'styles' of VM: some faster but less secure, some more secure but less fast, etc.
Of course, the problem with this is pretty obvious: the size. A protected application with all protection options disabled is around ~2mb from the original ~100kb. Luckily, Themida also has a packing feature to reduce the size, where it reduced it to around ~1mb.
Themida also has a few other features: "ClearCode", where it clears the assembly after it ran, "Encode", decrypting the code at runtime and re-encrypting it after it was executed, string encryption, and functions to check code integrity.
Conclusion
Both protections are quite good when used properly. Which one you buy is up to you, not me, so I would recommend you to choose wisely for the application you wish to protect and to see which features you specifically want.
