Free demo
Download Dhaedalida
Try VM protection on your own binaries. No account, no credit card: just download, unzip and protect your first build.
About the demo: the demo exposes the core VM engine. Virtualize real
functions in your own builds and inspect the protected output. Its virtualization is
lighter than in the Basic and Pro editions, and it does not include the packer, string
encryption, or the anti-analysis suite. It is feature-limited, not time-limited: it
never expires and needs no account or license file. Binaries protected with the demo
display a brief splash screen at startup identifying the Demo edition; output produced
with a purchased license starts without it.
System requirements
What you need to run Dhaedalida
| Operating system | Windows 10 or Windows 11 (64-bit). Windows Server 2019 / 2022 supported. |
|---|---|
| Processor | x64 CPU, 2 GHz or faster |
| Memory | 4 GB RAM minimum, 8 GB recommended |
| Disk space | ~120 MB free space (portable folder, no installer) |
| T-Rex output | Requires AVX2 on the target machine. Available in Basic, Pro and Ultimate; not included in Demo. Rabbit and Bear do not add this AVX2 requirement. |
| Protected targets | Windows 32-bit and 64-bit .exe and .dll (PE32 and PE32+). Marker SDK bindings for any native x86/x64 language |
| Permissions | No administrator rights needed: unzip and run. If Windows reports a missing VC++ runtime, run the included vc_redist.x64.exe once. |
Changelog
What's new
Version numbers below track the full product. The demo download above currently ships build 1.6.0.0.
Version 1.8.0.0
October 19, 2026- New virtual machine: Musky.
- Fixed a bug where the entry point (OEP) of Delphi applications was not virtualized because of @Halt.
- Improved recognition of function boundaries in Delphi binaries.
- Functions can now be loaded automatically from a .map file when a .pdb is unavailable.
- Copying functions now respects the active filter: hidden rows are excluded from right-click and keyboard copy actions.
Version 1.7.0.0
October 16, 2026- New virtual machine: Wasp.
- New feature: Advanced Options. Enable or disable internal features of Dhaedalida with variables supplied by customer support.
- String encryption now works when a string is shared between protected methods.
- Improved anti-debugging: it now works with the packer disabled.
- Programs with a zero-filled TLS (such as Delphi applications) can now be protected.
Version 1.6.0.0
October 13, 2026- New virtual machine: Rhino.
Version 1.5.0.0
October 4, 2026: Ultimate edition- Ultimate edition is released, with trials, licenses, hardware locks and country blocking.
- Sidebar buttons can now be rearranged.
- Add a custom startup splash image in Misc, with click, timed or SDK-controlled closing.
- Bear now supports virtualizing more entrypoints.
Version 1.4.0.0
September 29, 2026- Wolf virtualization for native x86 and x64, using SSE2.
- Virtual Files bundles read-only resources and supported DLLs in packed EXEs, compressed and encrypted without disk extraction.
- Customer watermarks with recipient patterns and file search.
- Improved function selection, Recent project management and VM comparisons.
Version 1.3.0.0
September 25, 2026: T-Rex release- New virtual machine: T-Rex.
- Added function to Show Disassembly of a function using right click.
- Sorting Virtual Machines types by speed, complexity or size is now possible.
- Fixed intermittent crashes in packed 32-bit programs using anti-debug protection and improved thread-context handling on both architectures.
Version 1.2.12.0
September 2026: Feature update- New Hide Section Names option
- Old exception handlers of protected methods are now removed
- Virtual machine entries are further protected against static analysis
- Reworked several GUI icons so no icon is repeated
Version 1.2.11.0
September 2026: Maintenance update- Fixed an x64 Bear compatibility regression
Version 1.2.10.0
September 2026: Feature update- Bear string encryption now supports native 32-bit EXE and DLL files
- Decreased false positives of anti-debug and DhaedalidaIsDebuggerPresent()
- Further hardened virtual machine entries
- Compatibility fixes for the Rabbit and Bear VMs
- Reduced memory usage
Version 1.2.9.0
September 2026: Maintenance update- Packed files now preserve PDB metadata through compression and anti-tampering, unless --strip is selected
- General compatibility bug fixes
Version 1.2.8.0
September 2026: Maintenance update- General stability bug fixes
Version 1.2.7.0
September 2026: Maintenance update- General stability bug fixes
Version 1.2.6.0
September 2026: Feature update- Added new SDK marker DhaedalidaIsImagePatched(), which checks whether the program has been modified
- Improved anti-emulation
- Improved Bear VM resistance against automated attacks
- Improved anti-dump
- Virtual machine entries are now better protected against static analysis
- When using the packer, original section names are now protected
- Decreased false positives of anti-debug
- Added internal error code for anti-debug
- General compatibility bug fixes
Version 1.2.5.0
August 2026: Feature update- Added new SDK function DhaedalidaIsDebuggerPresent()
- Compatibility changes
Version 1.2.4.0
August 2026: Feature update- New anti-hook feature: previously part of anti-debug, now a separate option
- Added support for atomic operations inside the Rabbit VM
- Demo can now protect DLL files
- Improved compatibility with ARM processors
Version 1.2.3.0
August 2026: Feature update- Improved anti-tamper
- Added support for TLS in 64-bit programs
- Added support for exception handling for 64-bit programs
- Expanded support for virtualized functions: more functions can now be virtualized using the Rabbit / Bear VM
- Fixed bug where if a .dae file already existed, new marked functions were not being recognized
Version 1.2.2.0
August 2026: Feature update- Improved anti-dump compatibility with CreateThread and other Windows APIs
- Added support for anti-analysis features for DLL files
- Anti-emulation now works for 32-bit binaries
- Fixed bug where a protected DLL output had a .exe extension
Version 1.2.1.0
August 2026: Feature update- Added support for 32-bit DLLs with TLS
- Added buttons to Clear / Copy / Save the output log
- Added support protecting binaries compiled with Control Flow Guard
- New option to strip RTTI (Run-time type information) from C++ programs
- Functions tab information (VA, RVA, Name...) can now be copied with Ctrl+C or right click
Version 1.2
August 2026: Feature update- New virtual machine (Bear)
- Original virtual machine was renamed to Rabbit
- Added Virtual Machines tab to see all available virtual machines
- Added option to preserve Control Flow Guard
- Sections have default permissions now and are modified during runtime when needed and restored after
- Anti-emulation now works also on the packer stub
- Dhaedalida's binaries are now signed
Version 1.1.1.0
August 2026: Feature update- New protection: anti-emulation
- Increased the speed of packer code
- Decreased the file size of protected binaries
- Added a project settings file that remembers your last protection settings, plus quick opening of recent project files
- Added update functionality
Version 1.1.0.35
August 2026: Feature update- Added a name filter for protected functions
- Added a "Show only selected" option for the functions list
- Added a button to export the addresses of selected functions to a .txt file
- Bug fix: PDB parsing
- Bug fix: data imports are no longer selected by import protection
Version 1.1.0.28
August 2026: Maintenance update- Bug fixes and stability improvements
Version 1.1.0.7
August 2026: Feature update- New option to disable ASLR (Address Space Layout Randomization) on protected outputs
Version 1.1
July 2026: Feature update- Support for 32-bit (x86) binaries: protect PE32
.exeand.dlltargets alongside 64-bit
Version 1.0.0.2
July 2026: Maintenance update- Bug fixes and stability improvements in the demo build
Version 1.0.0
July 2026: Initial release- Code virtualization engine with per-build VM architecture and obfuscation hardening
- Per-string encryption (ANSI + UTF-16), decrypted only inside the VM
- Application packer with a composable tamper-resistance suite (anti-tamper, import protection, debugger / VM / sandbox resistance)
- Dhaedalida desktop app with automatic marked-function detection, with or without a PDB
- Marker SDK (
VMStart()/VMEnd()) and a command-line engine with list-file targets for CI
Version 0.9 (Beta)
May 2026: Public beta- Feature-complete virtualization + packer pipeline for evaluation
- Stability and compatibility fixes ahead of 1.0
FAQ
Common questions
Why does my antivirus flag the download?
Tools that rewrite and compress executables share traits with the packers malware uses, so some antivirus engines flag protection software preemptively. The zip on this page is exactly what we built: verify it against the SHA-256 shown above to confirm an authentic, unmodified download. If your antivirus quarantines it, restore the file and add an exclusion, and report the false positive to the vendor so their detection improves.
Will binaries I protect with Dhaedalida be flagged too?
Most protected builds run clean, but heuristic engines can occasionally flag virtualized or packed output, as with any protector, and no one can guarantee how third-party security software will classify a given binary. Scan protected builds as part of your release testing, code-sign your releases, and submit any false positives to the antivirus vendors (most offer a dispute process).
My application is getting flagged by lots of antivirus products
Software protectors rely on techniques that malware crypters also use (encrypted sections, dynamic API resolution and code obfuscation, among others), so some antivirus engines may wrongly flag a protected application as malicious. We recommend code-signing every application with a certificate after protecting it, which tends to reduce false positives. Most antivirus vendors also offer a channel to report false positives so their detection improves.
Can I digitally sign my protected files?
Yes, code signing is fully supported. The only requirement is the order: sign your files after protecting them, not before. A digital signature embeds a cryptographic hash of the file, and protection necessarily rewrites the file (adding new sections among other changes), so a signature applied before protection would no longer match and become invalid. Protect first, sign last: that way your signature covers exactly the bytes your users receive.
Is the demo download digitally signed?
Yes. Since build 1.2.0.0, every executable in the demo carries an Authenticode signature. You can additionally verify your download against the SHA-256 checksum published above: it is served over TLS from the same page as the file, and each build ships under its own versioned URL, so the checksum shown always describes exactly the zip this page links to.