Code Protection

DotFix NiceProtect features advanced security technologies, including DotFix Morphing(tm) and DotFix Virtualization(tm), designed to prevent code decompilation and analysis. Code can be selected in two independent ways: choose native functions from a compiler-generated MAP file, or place SDK markers around an exact critical region in the source code. MAP-based selection supports x86 and x64 applications; SDK markers currently support x86 applications only.

For MAP-based protection, enable MAP generation in your compiler settings and rebuild the application. Place the resulting MAP file beside the matching EXE, DLL, or OCX, open the binary in DotFix NiceProtect, and navigate to the Code Protection tab to view the project's function list.

Select the specific functions you wish to protect.

DotFix NiceProtect Virtualize Functions

Single-click to mark a function for protection. Double-click a function to inspect it in the built-in disassembler.

DotFix NiceProtect Disassembler

The disassembler includes a "Virtualized" toggle, allowing you to compare the original machine code with the morphed or virtualized output.

DotFix NiceProtect Virtualize Options

Note: The metamorphic engine generates unique polymorphic instructions and loops for every protection pass. Toggling the view will display a new variant of the code each time, demonstrating the dynamic nature of the protection that complicates static analysis.

DotFix NiceProtect Disassembler 2

Code Virtualization is highly effective against decompilation, particularly for critical VCL functions in Delphi and Free Pascal, which are often targeted by standard decompiler signatures.

Protection scope: MAP-based protection starts at the function entry and continues until the first instruction or construct that the selected engine cannot process. Depending on the function, this may be the entire body or only its prologue; the protection log reports the actual number of protected bytes. Protecting the entry is particularly useful against decompilers because the original function code is no longer present at its expected address. To protect an exact critical region inside an x86 function, use Virtualization Markers.