Functions Selecting

There is a list of functions names selected for virtualization. To change the list, click the Select Functions button. The below windows with the possibility to select functions should appear. Note that if you have a MAP file for the Input file, the list of functions will be shown, otherwise, Enigma will try to analyse the file itself and the functions names will be represented with their addresses.

Selection of Functions

Select the functions necessary for virtualization by checking them out. The information field at the bottom shows a disassembled listing of the selected functions. As for the function in color, see the Simulating topic below. Right-click on the list to see the pop-up menu.

• Go To - First Selected - allows you to scroll the list to the first checked function;
• Go To - Last Selected - allows you to scroll the list to the last checked function;
• Go To - Previous Selected - selects the previous checked function;
• Go To - Next Selected - selects the next checked function;
• Go To - Beginning List - scrolls the list to the beginning;
• Go To - End List - scrolls the list to the end;
• Select All - checks all functions in the list;
• Deselect All - unchecks all functions in the list;
• Invert Selection - checks the unchecked and unchecks the checked functions;

Accurate Selection

Accurate selection provides tools for easier navigation through the list of functions and their selection.

Enter Filter Expression - enter the text to sort the selected functions by. Only those functions that contain the text entered will be shown after you click the Apply button. This tool is very useful when the members of a particular class only should be selected. Just enter the class name, click the Apply button and only the members of this class will be shown.

Multiple Select - allows you to select and deselect a range of functions.

Show Functions - allows you to show only Selected or Not Selected functions, or both.

Right-click on the list to see the menu.

• Go to Disassembly - allows quick navigation to the Functions Selecting tab, for viewing a disassembled listing of the selected functions

Simulating

Simulating allows you to estimate how many times the selected functions have been executed in your application. While simulating, The Enigma Protector executes input file entering in Input Panel, inserts some counters into the executed processes that allow you to count the number of times that a particular function has been executed. The Enigma Protector reads the counters each second while the application is working.

Click the Start Simulating button to start the simulating process. To stop simulating, close the executed application or click the Stop Simulating button. If your application requires the Command Line for some purposes, enter it.

Note that this feature does not work with dll (COM/ActiveX etc) files, only exe files are supported.

After simulating you may uncheck the highly used or unused functions. But unselecting these functions is not a requirement, but is just a recommendation. If you think the functions should be virtualized, there is no difference how many times they are executed while simulating. Also note that virtualization of highly used functions may slow down work of your application and increase CPU loading, and virtualization of non-used functions may also be dangerous because there is no way to check out the workability of the selected functions after protection.

Functions in color:

• Grey color - The Enigma Protector is not able to simulate execution of this function and to count how many times it has been executed, or there were still no attempts of simulating;
• Blue color - the function was not executed during the last simulation;
• Green color - the number of times the functions were executed during the last simulation is above zero and below the highly used value. Such functions are ideal for virtualization;
• Yellow color - the number of executions of the functions is near to the highly used one. You will have to check out the working speed of your application after protection;
• Red color - the function is highly used, it is not recommended to select this function, because it will slow down the working speed of protected application.