Free demo
Download Dhaedalida
Try VM protection on your own binaries. No account, no credit card: just download, unzip and protect your first build.
About the demo: the demo exposes the core VM engine. Virtualize real
functions in your own builds and inspect the protected output. Its virtualization is
lighter than in the Basic and Pro editions, and it does not include the packer, string
encryption, or the anti-analysis suite. It is feature-limited, not time-limited: it
never expires and needs no account or license file. Binaries protected with the demo
display a brief splash screen at startup identifying the Demo edition; output produced
with a purchased license starts without it.
System requirements
What you need to run Dhaedalida
| Operating system | Windows 10 or Windows 11 (64-bit). Windows Server 2019 / 2022 supported. |
|---|---|
| Processor | x64 CPU, 2 GHz or faster |
| Memory | 4 GB RAM minimum, 8 GB recommended |
| Disk space | ~120 MB free space (portable folder, no installer) |
| Protected targets | Windows 32-bit and 64-bit .exe and .dll (PE32 and PE32+). Marker SDK bindings for any native x86/x64 language |
| Permissions | No administrator rights needed: unzip and run. If Windows reports a missing VC++ runtime, run the included vc_redist.x64.exe once. |
Changelog
What's new
Version numbers below track the full product. The demo download above currently ships build 1.2.4.0, the shipping build of the Version 1.2 feature set.
Version 1.2.5.0
August 2026: Feature update- Added new SDK function DhaedalidaIsDebuggerPresent()
- Compatibility changes
Version 1.2.4.0
August 2026: Feature update- New anti-hook feature: previously part of anti-debug, now a separate option
- Added support for atomic operations inside the Rabbit VM
- Demo can now protect DLL files
- Improved compatibility with ARM processors
Version 1.2.3.0
August 2026: Feature update- Improved anti-tamper
- Added support for TLS in 64-bit programs
- Added support for exception handling for 64-bit programs
- Expanded support for virtualized functions: more functions can now be virtualized using the Rabbit / Bear VM
- Fixed bug where if a .dae file already existed, new marked functions were not being recognized
Version 1.2.2.0
August 2026: Feature update- Improved anti-dump compatibility with CreateThread and other Windows APIs
- Added support for anti-analysis features for DLL files
- Anti-emulation now works for 32-bit binaries
- Fixed bug where a protected DLL output had a .exe extension
Version 1.2.1.0
August 2026: Feature update- Added support for 32-bit DLLs with TLS
- Added buttons to Clear / Copy / Save the output log
- Added support protecting binaries compiled with Control Flow Guard
- New option to strip RTTI (Run-time type information) from C++ programs
- Functions tab information (VA, RVA, Name...) can now be copied with Ctrl+C or right click
Version 1.2
August 2026: Feature update- New virtual machine (Bear)
- Original virtual machine was renamed to Rabbit
- Added Virtual Machines tab to see all available virtual machines
- Added option to preserve Control Flow Guard
- Sections have default permissions now and are modified during runtime when needed and restored after
- Anti-emulation now works also on the packer stub
- Dhaedalida's binaries are now signed
Version 1.1.1.0
August 2026: Feature update- New protection: anti-emulation
- Increased the speed of packer code
- Decreased the file size of protected binaries
- Added a project settings file that remembers your last protection settings, plus quick opening of recent project files
- Added update functionality
Version 1.1.0.35
August 2026: Feature update- Added a name filter for protected functions
- Added a "Show only selected" option for the functions list
- Added a button to export the addresses of selected functions to a .txt file
- Bug fix: PDB parsing
- Bug fix: data imports are no longer selected by import protection
Version 1.1.0.28
August 2026: Maintenance update- Bug fixes and stability improvements
Version 1.1.0.7
August 2026: Feature update- New option to disable ASLR (Address Space Layout Randomization) on protected outputs
Version 1.1
July 2026: Feature update- Support for 32-bit (x86) binaries: protect PE32
.exeand.dlltargets alongside 64-bit
Version 1.0.0.2
July 2026: Maintenance update- Bug fixes and stability improvements in the demo build
Version 1.0.0
July 2026: Initial release- Code virtualization engine with per-build VM architecture and obfuscation hardening
- Per-string encryption (ANSI + UTF-16), decrypted only inside the VM
- Application packer with a composable tamper-resistance suite (anti-tamper, import protection, debugger / VM / sandbox resistance)
- Dhaedalida desktop app with automatic marked-function detection, with or without a PDB
- Marker SDK (
VMStart()/VMEnd()) and a command-line engine with list-file targets for CI
Version 0.9 (Beta)
May 2026: Public beta- Feature-complete virtualization + packer pipeline for evaluation
- Stability and compatibility fixes ahead of 1.0
FAQ
Common questions
Why does my antivirus flag the download?
Tools that rewrite and compress executables share traits with the packers malware uses, so some antivirus engines flag protection software preemptively. The zip on this page is exactly what we built: verify it against the SHA-256 shown above to confirm an authentic, unmodified download. If your antivirus quarantines it, restore the file and add an exclusion, and report the false positive to the vendor so their detection improves.
Will binaries I protect with Dhaedalida be flagged too?
Most protected builds run clean, but heuristic engines can occasionally flag virtualized or packed output, as with any protector, and no one can guarantee how third-party security software will classify a given binary. Scan protected builds as part of your release testing, code-sign your releases, and submit any false positives to the antivirus vendors (most offer a dispute process).
My application is getting flagged by lots of antivirus products
Software protectors rely on techniques that malware crypters also use (encrypted sections, dynamic API resolution and code obfuscation, among others), so some antivirus engines may wrongly flag a protected application as malicious. We recommend code-signing every application with a certificate after protecting it, which tends to reduce false positives. Most antivirus vendors also offer a channel to report false positives so their detection improves.
Can I digitally sign my protected files?
Yes, code signing is fully supported. The only requirement is the order: sign your files after protecting them, not before. A digital signature embeds a cryptographic hash of the file, and protection necessarily rewrites the file (adding new sections among other changes), so a signature applied before protection would no longer match and become invalid. Protect first, sign last: that way your signature covers exactly the bytes your users receive.
Is the demo download digitally signed?
Yes. Since build 1.2.0.0, every executable in the demo carries an Authenticode signature. You can additionally verify your download against the SHA-256 checksum published above: it is served over TLS from the same page as the file, and each build ships under its own versioned URL, so the checksum shown always describes exactly the zip this page links to.