3

I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find many comparisons. They are all in a similar price range so that is not a huge problem. I was wondering what the main differences are between them? Virtualization, string encryption, packing etc. I couldn't find much info about that.

All replies are appreciated! Thanks

4
9

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.

This comparison will only include the protectors I personally have a licence for: VMProtect and Themida. I do not have a licence to Enigma, so I cannot tell about its protection features.

I will also not be including the licencing features of either, I will only be talking about the protection methods they employ.

To get us started, here is the "unprotected" version of a simple loop function that we will be protecting with both protectors to see what they output.

VMProtect

VMProtect has 3 protection modes: Mutation, Virtualization, and "Ultra" (both methods combined)

Mutation does what it says it does: it mutates the assembly code to make automated analysis of it harder. The resulting mutated code varies drastically per compilation.

On the other hand, Virtualization translates the code into a special format that only a special virtual machine can run. It then inserts a "stub" function to call the VM where the actual code was supposed to be ran.

Note that this VM inserts a lot of overhead. The original ~100kb application was increased to around ~600kb after protection using this method. You can decrease the size though by turning on the packing feature inside of VMProtect.

There is also functionality for checking if debuggers are being ran, string encryption, methods of grabbing a unique identifier for the computers hardware, etc.

Themida

Themida is a little different from VMP. While it also has the same protection features of VMP, it does it much differently and has a few more features that VMP does not have. Note though that these features that VMP does not have do not work on all application types.

For Themida's Mutation, it does it quite differently to VMP. It adds lots of random operations to the assembly instead of specifically mutating each opcode.

Themida's Virtualization however has one cool feature that VMP does not: Multiple VM architectures. Themida has the ability to have different virtual machines (using a different architecture) inside of the same application. There is also different 'styles' of VM: some faster but less secure, some more secure but less fast, etc.

Of course, the problem with this is pretty obvious: the size. A protected application with all protection options disabled is around ~2mb from the original ~100kb. Luckily, Themida also has a packing feature to reduce the size, where it reduced it to around ~1mb.

Themida also has a few other features: "ClearCode", where it clears the assembly after it ran, "Encode", decrypting the code at runtime and re-encrypting it after it was executed, string encryption, and functions to check code integrity.

Conclusion

Both protections are quite good when used properly. Which one you buy is up to you, not me, so I would recommend you to choose wisely for the application you wish to protect and to see which features you specifically want.

5
  • Thank you so much for this! I've been messing around with these 2 applications on my friends pc but I can't figure out one thing. How to encrypt string with the sdk? I can't seem to figure that out.
    – Fomic
    Nov 13 '17 at 6:43
  • If I am correct, for VMProtect do VMProtectDecryptStringA/W, for Themida use the STR_ENCRYPT_START/STR_ENCRYPT_END macros.
    – 3dsboy08
    Nov 13 '17 at 12:32
  • do you use the macros like this STR_ENCRYPT_START string example = "hello" STR_ENCRYPT_END or string example = STR_ENCRYPT_START"hello"STR_ENCRYPT_END
    – Fomic
    Nov 13 '17 at 13:06
  • also im looking into the vms. any suggestions which vms should i use for themida and vm protect?
    – Fomic
    Nov 13 '17 at 13:11
  • You put the macro on top of the code.. and on the bottom of the code of each function it's the same for all macros VMProtect and Themida
    – SSpoke
    May 5 '20 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.