SDK functions

The SDK functions are used for integration into the source code of the protected application and serve to define the borders of protected sections and detect the use of debugging or virtualization tools.

Code markers

• VMProtectBegin
• VMProtectBeginVirtualization
• VMProtectBeginMutation
• VMProtectBeginUltra
• VMProtectBeginVirtualizationLockByKey
• VMProtectBeginUltraLockByKey
• VMProtectEnd

Utils

• VMProtectIsDebuggerPresent
• VMProtectIsVirtualMachinePresent
• VMProtectIsValidImageCRC
• VMProtectDecryptStringA
• VMProtectDecryptStringW
• VMProtectFreeString

Licensing functions

• VMProtectSetSerialNumber
• VMProtectGetSerialNumberState
• VMProtectGetSerialNumberData
• VMProtectGetCurrentHWID

VMProtectBegin

procedure VMProtectBegin(MarkerName: PAnsiChar);

VMProtectBegin, the marker that starts the protected section of the code, must be called before the first instruction (calling a procedure or function) in the protected block of the code. MarkerName defines the marker name that will look like "VMProtectMarker"+MarkerName in VMProtect. For example, the VMProtectBegin(‘CheckRegistration’) marker will look like VMProtectMarker "CheckRegistration". If no name is specified for a marker, it will be given a unique name of the following type: "VMProtectMarker"+marker ordinal number. The compilation type of the protected section is specified when the project is processed in VMProtect.

VMProtectBeginVirtualization

procedure VMProtectBeginVirtualization(MarkerName: PAnsiChar);

The marker that starts the protected section of the code with the predefined "virtualization" compilation type. MarkerName defines the marker name (see VMProtectBegin). It is impossible to change the compilation type specified by the marker later in VMPotect.

VMProtectBeginMutation

procedure VMProtectBeginMutation(MarkerName: PAnsiChar);

The marker that starts the protected section of the code with the predefined "mutation" compilation type. MarkerName defines the marker name (see VMProtectBegin). It is impossible to change the compilation type specified by the marker later in VMPotect.

VMProtectBeginUltra

procedure VMProtectBeginUltra(MarkerName: PAnsiChar);

The marker that starts the protected section of the code with the predefined "ultra" (mutation + virtualization) compilation type. MarkerName defines the marker name (see VMProtectBegin). It is impossible to change the compilation type specified by the marker later in VMPotect.

VMProtectBeginVirtualizationLockByKey

procedure VMProtectBeginVirtualizationLockByKey(MarkerName: PAnsiChar);

The marker that starts the protected section of the code with the predefined "virtualization" compilation type and the option “Lock to key“. MarkerName defines the marker name (see VMProtectBegin). It is impossible to change the compilation type specified by the marker later in VMPotect.

VMProtectBeginUltraLockByKey

procedure VMProtectBeginUltraLockByKey(MarkerName: PAnsiChar);

The marker that starts the protected section of the code with the predefined "ultra" (mutation + virtualization) compilation type and the option “Lock to key“. MarkerName defines the marker name (see VMProtectBegin). It is impossible to change the compilation type specified by the marker later in VMPotect.

VMProtectEnd

procedure VMProtectEnd;

The marker that ends the protected section of the code. VMProtectEnd must be called after the last instruction (calling a procedure or function) in the protected block of the code.

VMProtectIsDebuggerPresent

function VMProtectIsDebuggerPresent(CheckKernelMode: Boolean): Boolean;

This VMProtect API function allows you to detect when the application is running in the debugger. The result of its work (True/False) can be processed by the protection mechanisms built into the application. If CheckKernelMode=False, the function checks for the user-mode debugger (OllyDBG, WinDBG, etc.). If CheckKernelMode=True, both user-mode and kernel-mode debuggers will be detected (SoftICE, Syser, etc.). In case of driver protection, CheckKernelMode does not matter because drivers run in the kernel mode so it is always checked if kernel-mode debuggers are running for them.

VMProtectIsVirtualMachinePresent

function VMProtectIsVirtualMachinePresent: Boolean;

This VMProtect API function allows you to detect when the application is running in a virtual environment: VMware, Virtual PC, VirtualBox, Sandboxie. The result of its work (True/False) can be processed by the protection mechanisms built into the application.

VMProtectIsValidImageCRC

function VMProtectIsValidImageCRC: Boolean;

This VMProtect API function allows you to detect changes made in the application memory. The result of its work (True/False) can be processed by the protection mechanisms built into the application.

VMProtectDecryptStringA

function VMProtectDecryptStringA(Value: PAnsiChar): PAnsiChar;

VMProtectDecryptStringA function allows to decrypt ANSI string constant. You have to add this constant to a list of protected objects.

VMProtectDecryptStringW

function VMProtectDecryptStringW(Value: PWideChar): PWideChar;

VMProtectDecryptStringA function allows to decrypt Unicode string constant. You have to add this constant to a list of protected objects.

VMProtectFreeString

function VMProtectFreeString(Value: Pointer): Boolean;

VMProtectFreeString function allows to free the decrypted string.