we have a special code need to running under native mode, just like chkdsk.exe, in this mode, only ntdll.dll is available, no Win32.
So if I use VMProtect to protect the native program, it will import kernel32.dll, then it will caused the native program can not run.
Does anyone know how to solve this problem?
Thanks in advanced.
Could you send us a native application example? chkdsk.exe from my Windows7-x64 imports APIs from kernel32.dll
I have send the native program by mail.
BTW, the native program I say chkdsk is not exactly right, it should be autochk.
What features of VMProtect are you going to use for your application?
I want to protect some key codes, so Mutation or Virtualization both OK for me.
I meant additional options “Import/Memory protection”, “Packing”, etc.
In Option Setting, Level I will select “Maximum speed”, No Memory /Import protection, no pack output file. Other setting I will keep default.
No Memory /Import protection, no pack output file
In this case VMProtect doesn’t add any imports.
P.S. Anyway, VMProtect doesn’t add kernel32.dll into imports because it detects your application as a driver 
(1) I use VMProtectSDK.pas in my project, and I add VMProtectBeginMutation/VMProtectEnd.
(2) Compile with Delphi to generate the win32 exe, because Delphi can not directly compile the subsystem = native program.
(3) then I remove the other import block, only keep ntdll.dll and VMProtectSDK32.dll
(4) In this time, Open the exe(native) in VMProtect, the Mark I had add before can not be found.
Here is the new problem.
I already know that you use Delphi for your application ) For example I found unused “.rsrc” section. I strongly recommend don’t modify PE format of your application because it can be incorrect after modifications.
(4) In this time, Open the exe(native) in VMProtect, the Mark I had add before can not be found.
It seems that VMProtect didn’t find references on APIs from SDK. Possible import/relocation directories were corrupted.
I maybe found the problem now:
if I use VMProtectSDK.pas and it will import kernel32.dll, when I change the program to native by wipe off un-used Import Blocked, only keep ntdll/VMProtectSDK32, it will can not found the Mark I add by VMProtectBeginXXX/VMProtectEnd.
if I keep ntdll/VMProtectSDK32/Kernel32 Import Block, remove other unused Import Block, VMProtect will detect the Mark, BUT, after compile, VMProtect can not consider this native program as sub-system = native, and it import user32.dll and kernel32.dll, not hal and ksornel.
So the only way is I can not add the mark in my code? in this way, I can not extactly decide which code range will be protect. and I can not build the program in the script.
Thank you very much. I will try to test 3 first.
I have try the map file before, it’s ok for protect one procedure, but if I want to protect part of code in procedure, such as I maybe only want to protect some if/else cause, it will need to add my own mark, and every time I need un-asm first my program.
I change the VMProtectSDK32.dll to VMProtectDDK32.sys, but it still can not detect the mark.
I think I can try another way, that is my program directly compile with obj of VMProtectDDK32?? but I need OMF format lib or obj files, because Delphi only can use OMF format.
is it Ok? can you send me OMF format DDK32/64 lib or objs?
I change VMProtectSDK32.pas as following:
const
{$IFDEF WIN64}
//VMProtectDLLName = ‘VMProtectSDK64.dll’;
VMProtectDLLName = ‘VMProtectDDK64.sys’;
{$ELSE}
//VMProtectDLLName = ‘VMProtectSDK32.dll’;
VMProtectDLLName = ‘VMProtectDDK32.sys’;
{$ENDIF}
then compile with Delphi, and it’s running OK, then I remove the ununsed import block, only keep ntdll and VMProtectDDK32, change subsystem to native, then open in VMProtect, but Mark still can not be found.
/*
can you tell me how to continue for testing?
Could you send us this file?
P.S. Guys, you are very patient that you use Delphi instead of Visual Studio. VS can compile your application without any dirty hacks and you will save your and our time for solving your “problems”.
I think I can try another way, that is my program directly compile with obj of VMProtectDDK32?? but I need OMF format lib or obj files, because Delphi only can use OMF format.
As I know Delphi doesn’t need any lib or obj files for dynamic linking. So it’s doesn’t matter what format Delphi uses )
Sorry to give you so much trouble.
Maybe you can check the purchase order, we have got this product half an year ago, and Win32 App, Drivers we only take 3 days to complete with the VMProtect, and it’s perfect. only this native program we have try lots of way, can not solve it.
Our product developed with Delphi has more than 5 years, we are headache about the cracked problem, so we decide to use VMProtec to protect. So maybe you can understand why I can not use VS. it’s impossible for a 5 years product to new coding from one language to other language, also all the program in our company only use FreePascal or Delphi.
we will try our best for others ways, if you can find a new way, we are appreciate that you can send it to me by mail.
Thanks agian.
I have one idea. You need:
What do you think?
I have try this way before, the Rawoffset inf section have been clear after VMProtect, so our hacking tools can not run.
I think things is over, I have move the key code fragment to run under kernel driver, thanks for ur hlep these days!!