MAP file - what is it?
A MAP file is a type of file that has the same name as an executable EXE program or DLL / OCX library but with the MAP extension instead. This file is created by the linker during the compilation process when building a binary program and contains information about all procedures and functions within it. The MAP file includes important addresses found in the executable file, which can be used for software protection purposes such as selection of functions and procedures for virtualization.
One major advantage of using a MAP file over other methods like heuristic search is that if the addresses change during subsequent compilations, the protection will still know exactly which functions were chosen for virtualization since their names usually do not change.
However, there are different ways to generate a MAP file depending on the programming environment being used and its format can vary greatly between different compilers. Currently, DotFix NiceProtect supports several formats including Embarcadero Delphi / C++Builder, GCC (both C++ versions as well as FreePascal Lazarus compiler), MS Visual Studio, and even older versions of Visual Basic 5.0/6.0. All these formats are supported along with basic name demangling (decryption) and filtering out potentially unused for protection purposes data, such as constants, classes, segments, etc.. Supported both 32x and 64x bit versions.