Defense suites
The protections grouped by the attack they stop. Pick a suite to see what it is for; the options behind it are in Options and levels.
Open it now:Obfuscator, Protect
Reverse-engineering defense
Opened in a decompiler, the file yields nothing usable. Aimed at IDA Pro and Hex-Rays, Ghidra, Binary Ninja, radare2, Tigress and Triton. It combines hidden strings, a hidden import table, a rewritten PE header and measures that stall or crash analysis tools. Options: Anti-analysis, Code transform and part of Packaging.
Debugger resistance
Attach a debugger and the process is already gone. Aimed at x64dbg, WinDbg, OllyDbg, ScyllaHide and IDA's attach. Options: Anti-debug.
Process injection resistance
Foreign code cannot live inside it. Aimed at Frida, Cheat Engine, manual mappers, DLL injectors and reflective loaders. Options: Anti-inject. Some levels can break plugin systems and overlays that your own users rely on.
Memory acquisition resistance
Read its memory and you get nothing useful. Aimed at Scylla, pe-sieve, ProcDump, hollows_hunter and MiniDumpWriteDump. Options: Memory.
Code virtualization
The function worth stealing no longer exists as native code: it is translated to the instructions of a virtual machine that is different in every build and that nobody has a specification for. Aimed at static recovery, VM lifting, Triton and manual devirtualization. Options: Virtualization. It makes the protected parts slower, so use it on the code that matters, not on hot loops.
Semantic integrity binding
Patch anything, anywhere, and the program stops working correctly, quietly. Aimed at byte patching, removing checks and bypassing mitigations. Options: Integrity and Tamper response, which decides what happens when a check trips: end the process, degrade silently, or something louder.