Some of the features
- Multilevel encryption.
- Implementation of never before seen anti-debugging techniques.
- Advanced detection of cracking tools.
- Scrambling and stealing executable code.
- API transformation to hinder the reconstruction of an original application.
- Advanced protection against disassembling.
- Hidden ways to verify the correct behaviour of the running program.
- Advanced technology preventing dumping from memory to disk.
- Advanced OEP stealing.
- Advanced anti-tracing.
- On the fly decryption and re-encryption.
- Advanced embedding and fixation from protection code with protected program.
- Virtual Machine Technology.
- Polymorphic engine.
- ... and so much more!
Requirements
lARP64 brings too many features in the game to mention them all here. However, a brief look in the path that crackers follow to break software protection, already reveals why lARP64 is so unique. Thanks to lARP64Pro, developers don't need any source code changes or specific programming knowledge to protect their applications.
Our protector not only uses the well-known redirection methods of Windows APIs but lARP64Pro pushes these methods another level up. Additionally, the following methods have also been implemented in a renovating way (and far more, the list is kept deliberately incomplete):
Clearly, this makes even the basic example above hard to understand as it seems like something completely different! Obviously, this is only a brief example, imagine one has to study lots and lots of code like this ... .
lARP64 Technology
Our 64 bit program protector uses the lARP64 technique. This is a new and advanced technology consisting of a number of different layers of protection, not only to detect and circumvent cracking, but also to hide the detection of every possible cracking attempt. It is a path to ensure that each application is uniquely protected whilst avoiding general attacks. In this technique, lARP64Pro uses very annoying obfuscation and code hiding. To understand this better, one needs to know that a cracker breaks someone else's code under debugger and/or disassembler. lARP64Pro makes the code's readability as well as the studying from the disassembled code a real pain. The resulting disassembler can only be understood by stepping the code under debugger one line at a time. This process makes cracking very hard and very time consuming, especially since the transformation is unpredictable. Let's see a real-world example taken from an existing protected application. After its disassembling under debugger or under disassembler, the real code would look like 3 easy lines of assembler code, but in lARP64Pro code, this looks completely different:
Copyright (c) 2006-2010 lARP64Tech Software All rights reserved
Why protection
If you are in shareware development, you simply need to protect your programs to secure your revenues. Estimates on how much money is annually lost from cracking and illegal use of software vary big time. But the point is that money is lost … not just money, your money is lost. All developers need to take steps to protect their programs from being used in an illegal way. However, it is a long and difficult way to learn everything about cracking: it has taken us years to get there. But now, we have specifically developed lARP64 technology to help you achieve your goal: to protect your revenues. lARP64Pro is your best choice to do that for you !
SITE
NAVIGATION
HOME
PRODUCTS
TECHNOLOGY
DOWNLOAD
ORDER
SCREENSHOTS
HELP
Technology
The Virtual Machine
"The virtual machine: a way of understanding software that frees us to think of software design as machine design."
Quote from David Gelernter in "Truth, Beauty, and the Virtual Machine," Discover Magazine, September 1997.
The lARP64Pro VM
Like said before, lARP64Pro technology uses a partial process VM, partial being used in the meaning that only the "sensitive" code parts are virtualized (there is no need to virtualize the complete program). Since the technology is developed for lARP64Pro exclusively, it means a great advantage in holding off crackers.
Use
Polymorphic engines are mainly used in computer malware. In this case, the function of the polymorphic engine is to make it difficult for virus scanners to detect and identify the virus. The malware uses the polymorphic engine to encrypt itself in a different way for each program that it infects. As a consequence, it is impossible to detect the virus by searching for a fixed signature in program files, because every part of the encrypted virus is subject to change. Another use of a polymorphic engine is in advanced protection software where the poly-engine makes sure each protected software is strongly different, even when protecting the same executable. This results in an elevated difficulty for the cracker since there is no easy way in determining what protection mechanism was used. More importantly, this hinders or even avoids generic unpacking mechanisms and their tools.
It has been stated many times and by different authors before: the future for software protection lies in the development and use of virtual machine technology. Indeed, software virtualization can make it many times harder to crack the virtualized software since it requires extensive study first and it may take quite long before someone even begins to understand what exactly is going on.
lARP64Tech has developed its own virtual machine technology, more exactly a partial process virtual machine technology. Since this is a great advantage in protection capabilities, let's see more indepth what it means.
General info
A virtual machine was originally defined as a duplicate of a real machine. A virtual machine -often abbreviated to "VM'- is a software implementation of a computer ("machine") that executes programs in the same way as a real computer. One essential characteristic of a virtual machine is that the software running inside is limited to the resources provided by the virtual machine: the VM can't escape its virtual environment. Nowadays, the term also refers to software implementations having no direct correspondence to the hardware.
Recently, Virtual machines were divided into two major categories. At first, there is the system virtual machine. It provides a complete system platform allowing the execution of a complete operating system. Next, there is the process virtual machine. It is designed to execute a single program (a single process) or even only a part of a program. A process VM provides a high-level abstraction compared to the low-level abstraction of the system VM.
Process virtual machines
The system VM is less important regarding lARP64Pro, so let's focus on the process VM. A process VM -or application virtual machine- runs as a normal application inside an OS and supports a single process. It is created when that process is started and ended -hence destroyed- when it exits. Its purpose can be to allow a program to execute in the same way on any platform, but it can also be to allow a program to run within the protected environment of the VM. Obviously, lARP64Pro aims at the latter.
Process VMs are implemented using an interpreter (software). An interpreter meaning a computer program that executes another program's code. This can mean that it executes the source code directly or translates source code into some efficient intermediate representation which is next executed.
The lARP64Pro polymorphic engine
The best polymorphic engines work low-level (machine code or assembler), hence, lARP64Tech has developed and implemented in lARP64Pro a low-level poly-engine which inserts, alters and "morphs" the code without altering the code flow. The result is that the cracker can not easily recognize the used protector and there is no way or at least no easy way to generic unpack such a protected application. Still, the protected program functions exactly like before. Let's discuss some generalities and the use in detail.
General info
A polymorphic engine is a synonym for a mutation engine or a mutating engine, also sometimes abbreviated to poly-engine. It is a computer code or (part of) a program that is used to transform another program into a version that consists of different code (opcodes) but with the same functionality. A typical polymorphic engine works by encrypting the target program. This can happen in many different ways, also the provided decryption module can vary widely. However, more advanced polymorphic engines can also randomly create and insert executable but not really needed instructions (fake code) anywhere between the original instructions.
Ease of use
With the above and the non-mentioned features in mind, one might expect lARP64Pro to have become a rather difficult to handle program. It is exactly the opposit! lARP64Pro is easy as 1-2-3. Indeed, we have deliberately only provided one single checkbox that offers the ability to skip some of the advanced protection options in one click. Reason to uncheck this box is only in the rare case your protected application fails otherwise. Our engineers have created lARP64Pro so ingeniously that there is no need to skip certain functions! lARP64Pro always provides the very strongest possible protection because that is what anti-cracking is all about, right?