The Native protection is based on a vaccine implemented as a universal external module. All protection functions are supported by this module.
This serves for complete unification of the protection process.
Here is the description of Guardant automatic protection:
A small executable module is embedded into the body of the protected application (internal vaccine). At the application startup it loads an external vaccine from a separate file. And the latter performs all necessary checks and conversions of protected application’s code and launches of the application.
Besides, the use of the external module of protection enforces the tamperproofness of the system and prevents the learning of its logic using debuggers.
The Guardant vaccine file is named GrdVkc32.dll, which is included into the automatic protection kit.
Warning
GrdVkc32.dll vaccine must be located in a folder accessible by LoadLibrary function during the protected application startup (in the current folder, system folders of Windows, protected application folder, one of the folders of PATH list).