Documentation

Full CLI reference. Each flag includes what it does, what it affects, available values, default, when to use it and an example.

Public beta & licensing

macOS and Windows betas ship with self-serve demo keys and online activation. Linux CLI beta (x86_64 host) protects ELF64 x86_64 and aarch64 with the same demo product. Windows PE CLI reference follows below.

1) Get a demo key (browser)

https://akiprotect.core-jmp.org/demo.php
# 14-day RSA serial · product 0x414B4944 · emailed + shown on page

2) Download betas

https://akiprotect.core-jmp.org/beta.php
# macOS: AkiMacProtector.app + aki_mac_builder + sdk/ (+ Swift) + Open-Mac.command
# Windows: per-arch zips (x64 / x86 / arm64) — x64/x86 include dotnet_wrap_stub.exe
# Linux CLI: aki_lin_builder --protect / --license-bind (ELF64 x86_64 + aarch64)

3) Verify zip checksum (optional)

curl -fsSL https://akiprotect.core-jmp.org/downloads/SHA256SUMS -o SHA256SUMS
# after download:
shasum -a 256 -c SHA256SUMS
# Windows (PowerShell):
# Get-FileHash .\AkiProtect-Windows-x64-0.34.0.zip -Algorithm SHA256

4) First launch on macOS (ad-hoc / Gatekeeper)

# After unzip:
./Open-Mac.command
# or: right-click AkiMacProtector.app → Open
# or: xattr -cr AkiMacProtector.app && open AkiMacProtector.app

5) Verify serial + online activate (CLI)

./aki_mac_builder --rsa-verify --rsa-pub ./keys/demo.pub 'YOUR-SERIAL'

./aki_mac_builder --activate \
  --url https://akiprotect.core-jmp.org/activate.php \
  --serial 'YOUR-SERIAL' --rsa-pub ./keys/demo.pub --product 0x414B4944 \
  -o ticket.aktk

./aki_mac_builder --ticket-verify --rsa-pub ./keys/demo.pub ticket.aktk

6) Protect with demo serial (binds to this Mac)

./aki_mac_builder --protect --license-rsa 'YOUR-SERIAL' \
  --rsa-pub ./keys/demo.pub --verify-sign -i MyApp.app -o MyApp_protected.app

7) Linux CLI beta (x86_64 host → x64/aarch64 ELF)

# glibc x86_64 host after unzip:
./aki_lin_builder --hwid
./aki_lin_builder --elf-info -i /bin/ls
./aki_lin_builder --protect -i ./hello -o ./hello_p
AKI_LIN_RUNTIME_PROBE=stderr ./hello_p

# Demo RSA + bind (same product 0x414B4944):
./aki_lin_builder --rsa-verify --rsa-pub ./keys/demo.pub "$SERIAL"
./aki_lin_builder --embed-runtime --license-rsa "$SERIAL" --rsa-pub ./keys/demo.pub \
  -i ./hello -o ./hello_p
# Details: https://akiprotect.core-jmp.org/linux.php
POST /activate.php

Online ticket API (WebLM wire format).

What it doesJSON body: serial, hwid, product, version. Returns signed BpActivationTicket (base32) plus grace_days.
Accepted values
  • Product 0x414B4944 (demo) only on this host
  • Max 3 distinct HWIDs per demo serial
  • Ticket expDate follows serial expiry
  • Client grace after expiry: 3 days (--activation-grace)
Example
curl -X POST https://akiprotect.core-jmp.org/activate.php \
  -H 'Content-Type: application/json' \
  -d '{"serial":"…","hwid":"…","product":"0x414B4944","version":1}'

Quick start (Windows PE — shipping product)

Windows is the mature product (GUI, CLI, SDK). Three commands cover 90% of native PE usage; .NET uses --dotnet-* (not CLR packing). Full PE CLI reference follows.

Pack an EXE with the recommended Release defaults

AkiProtect_builder.exe --i myapp.exe --lz4 --vm --ulam-layout

Pack a DLL with a startup export

AkiProtect_builder.exe --i my.dll --o my_packed.exe ^
    --lz4 --vm --dll-export RunMe

Mode B in-place + --output-dll (DLL host)

AkiProtect_builder.exe --mode inplace --i myapp.exe --virt-mode virtualize --virt-func 0x401000
AkiProtect_builder.exe --i my.dll --o my_host.dll --output-dll --lz4 --vm

.NET wrap (native CLR-host EXE — not Mode A CLR packing)

AkiProtect_builder.exe --dotnet-wrap --i managed.dll --o managed_host.exe
# stub next to builder: x64\dotnet_wrap_stub.exe (x86 zip too; not in arm64)

Mode A vs Mode B vs --output-dll

Three common shipping shapes. Mode A is the classic stub+payload packer. Mode B mutates the input image in place. --output-dll changes the Mode A launcher shape from EXE to DLL.

Mode A (default) — stub wraps encrypted payload

AkiProtect_builder.exe --i myapp.exe --lz4 --vm --ulam-layout
# → myapp_packed.exe  (stub PE + payload tail)

Mode B — in-place protect (needs ranges or SDK markers)

AkiProtect_builder.exe --mode inplace --i myapp.exe \
  --virt-mode virtualize --virt-func 0x401000
# Prefer SDK markers (AKI_PROTECT_BEGIN / …) when you own the source.

Mode A DLL host — wrapper DLL instead of EXE launcher

AkiProtect_builder.exe --i plugin.dll --o plugin_host.dll \
  --output-dll --lz4 --vm
# Requires DLL input. Not with --classic-stub.
--mode stub

Mode A — stub wrapper (default).

What it doesBuilds a stub PE that decrypts/loads your original image from the payload tail at runtime. Best default for shipping a single EXE.
Defaultstub
When to useRelease packs, loaders, most native EXE/DLL payloads.
--mode inplace

Mode B — in-place mutate / virtualize.

What it doesPatches the input PE: selected code ranges become VM/mutated; runtime entry is injected. No separate Mode A stub overlay. Requires --virt-func / --virt-range and/or SDK markers in the binary.
When to useYou own the source or can mark ranges; want the protected image to stay “the same PE” for tooling/signatures workflows.
Example
--mode inplace --virt-mode virtualize --virt-func 0x401000
--output-dll

Mode A output as a wrapper DLL.

What it doesDLL input required. Default --o extension becomes .dll. Host loads your DLL and runs the packed payload (optional --dll-export). Mutually exclusive with --classic-stub.
RejectedEXE input with --output-dll; combining with --classic-stub.
Example
--i plugin.dll --o plugin_host.dll --output-dll --lz4 --vm

Do not feed managed CLR PE to Mode A. Use --dotnet-* / --dotnet-wrap instead. macOS primary model is Mode B–style in-place protect (aki_mac_builder --protect).

.NET obfuscator & --dotnet-wrap

Managed assemblies are a separate pipeline. The native Mode A stub packer rejects CLR PE. Use --dotnet-* to obfuscate, or --dotnet-wrap to embed the assembly in a native CLR-hosting EXE (needs .NET Framework 4.x at runtime).

Wrap assembly in native host EXE

AkiProtect_builder.exe --dotnet-wrap --i MyLib.dll --o MyLib_host.exe
# Looks for dotnet_wrap_stub.exe next to the builder (shipped in x64/x86 beta zips).

Override wrap stub path

AkiProtect_builder.exe --dotnet-wrap --dotnet-wrap-stub C:\tools\dotnet_wrap_stub.exe \
  --i MyLib.dll --o MyLib_host.exe
--dotnet-wrap

Embed managed assembly in a native CLR-host EXE.

What it doesProduces a native PE that hosts the CLR and loads your assembly. This is not Mode A packing of CLR metadata. Runtime: .NET Framework 4.x.
When to useYou want a single native EXE entrypoint for a managed DLL/EXE without feeding CLR to the native packer.
Example
--dotnet-wrap --i managed.dll --o managed_host.exe
--dotnet-wrap-stub <file>

Override path to the CLR-host stub.

What it doesDefault is bin\dotnet_wrap_stub.exe (or the copy next to BinaryProtector_builder.exe in the beta zip). Not built for ARM64 yet — use x64/x86 hosts.
Defaultdotnet_wrap_stub.exe beside the builder
Example
--dotnet-wrap-stub x64\dotnet_wrap_stub.exe
--dotnet-* (obfuscator family)

Separate .NET obfuscation flags (see full manual).

What it doesString encryption, control-flow, rename, etc. on managed assemblies. Distinct from native PE Mode A/B. See docs/dotnet_obfuscator.md in the Windows tree.
RejectedPassing a CLR PE to --i without --dotnet-* / --dotnet-wrap (Mode A rejects it).

Windows arm64 beta zip intentionally omits dotnet_wrap_stub (mscoree / NETFXSDK). Use x64 or x86 wrap on ARM64 Windows via x64 emulation if needed.

macOS SDK & Swift

The macOS beta zip includes sdk/ (C header + dylib + examples) and sdk/swift/ (SPM package). Markers stay C/ObjC; licensing APIs have a Swift façade.

C markers + protect

#include "AkiProtectSDK.h"
// AKI_PROTECT_BEGIN / AKI_PROTECT_END around hot functions

./aki_mac_builder --virt-markers --codesign adhoc -i MyApp -o MyApp_p

Swift Package (from sdk/)

./build_sdk.sh
cd swift
swift build -Xlinker -L../lib -Xlinker -lAkiProtectSDK \
  -Xlinker -rpath -Xlinker @loader_path/../lib
swift run AkiProtectLicenseSmoke

Swift licensing calls

try AkiProtect.setPublicKeyPath("./keys/demo.pub")
try AkiProtect.setActivationURL("https://akiprotect.core-jmp.org/activate.php")
AkiProtect.setProductCode()
let hwid = try AkiProtect.currentHWID()
try AkiProtect.setSerialNumber(serial)
try AkiProtect.activateOnline(ticketPath: "ticket.aktk")
AkiProtectSDK.h + libAkiProtectSDK.dylib

C API: markers, HWID, serial, activate.

What it doesShip-stripped markers (Begin / Virtualization / Mutation / Ultra / LockByKey). Runtime licensing helpers used with demo.pub + activate.php.
When to useNative C/C++/ObjC macOS targets in the beta zip under sdk/.
sdk/swift (SPM)

Swift façade over the licensing dylib.

What it doesModule AkiProtect wraps SetSerial / HWID / Activate. Markers cannot be emitted from Swift — keep protected regions in .c/.m.
Example
See sdk/swift/README.md and Examples/LicenseSmoke.
Open-Mac.command

Gatekeeper helper for ad-hoc builds.

What it doesRuns xattr -cr on AkiMacProtector.app and opens it. Needed until a paid Developer ID + notarize pipeline is available.

Full macOS CLI: macos.php and BETA_README.txt in the zip. Windows SDK (C/C#/Pascal) lives under sdk/ in the Windows per-arch zips.

Linux CLI beta (x86_64 host)

Mode B CLI for ELF64 x86_64 and aarch64. Host binary is glibc x86_64. Download from beta.php / linux.php. Includes demo.pub (same product as macOS/Windows). No GUI yet.

protect + probe

./aki_lin_builder --elf-info -i /bin/ls
./aki_lin_builder --protect -i ./hello -o ./hello_p
AKI_LIN_RUNTIME_PROBE=stderr ./hello_p

RSA verify + license-bind embed

./aki_lin_builder --hwid
./aki_lin_builder --rsa-verify --rsa-pub ./keys/demo.pub "$SERIAL"
./aki_lin_builder --activate --url https://akiprotect.core-jmp.org/activate.php \
  --serial "$SERIAL" --rsa-pub ./keys/demo.pub --product 0x414B4944 -o ticket.aktk
./aki_lin_builder --embed-runtime --license-rsa "$SERIAL" --rsa-pub ./keys/demo.pub \
  -i ./hello -o ./hello_p
--elf-info

Parse and dump ELF64 LE (x86_64 + aarch64).

What it doesRead-only; program headers, sections, dynamic.
--protect / --embed-runtime

Mode B PT_LOAD inject + stage2 (integrity, anti-debug, strenc).

What it doesSelects x86_64 or aarch64 bootstrap by e_machine. --protect enables integrity+anti-debug+strenc.
RejectedELF32, big-endian, or unsupported e_machine.
--hwid / --license-bind / --license-rsa / --activate

Demo licensing (Windows-compatible wire format).

What it doesHost HWID + runtime bind token; RSA-2048 serial; curl POST activate.php → .aktk.
When to useSame demo.pub / product 0x414B4944 as macOS and Windows betas.

Build/test on Debian x86_64 (see linux/docs/dev_vm.md). aarch64 E2E via qemu-user. Needs curl for --activate.

Input & output

Where AkiProtect reads from and writes to. Only --i is required for Mode A pack.

--i <file>

Input binary you want to protect.

What it doesNative PE becomes the Mode A payload (stub + encrypted image). For .NET use --dotnet-* / --dotnet-wrap instead of Mode A packing.
EffectRequired. Without --i the builder prints usage and exits.
Accepted values
  • PE32 (.exe) — x86 native Windows executable
  • PE32+ (.exe) — x64 native Windows executable
  • PE32+ (.exe, ARM64) — ARM64 native Windows executable
  • Load-only DLL — same three architectures
RejectedCLR PE fed to Mode A stub packer; kernel drivers; cross-architecture pack.
Example
--i C:\builds\myapp.exe
--o <file>

Path for the protected output.

What it doesWhere AkiProtect writes the result. Default is an EXE launcher; with --output-dll (DLL input) the default extension is .dll.
EffectNever overwrites --i unless you explicitly point at the same path.
Default<input-basename>_packed.exe (or .dll with --output-dll) next to the input.
Example
--o C:\dist\myapp_release.exe
--mode stub|inplace

Mode A stub wrapper (default) or Mode B in-place protect.

What it doesstub = classic packer (stub PE + payload tail). inplace = mutate/virtualize in the input image with runtime injection; needs --virt-func and/or SDK markers.
Defaultstub
Example
--mode inplace --virt-mode virtualize --virt-func 0x401000
--output-dll

Emit a wrapper DLL instead of an EXE launcher.

What it doesPhase 116: DLL input required. Default output extension flips to .dll. Mutually exclusive with --classic-stub.
Example
--i plugin.dll --o plugin_host.dll --output-dll --lz4 --vm
--stub <file>

Override the embedded runtime stub.

What it doesPath to a pre-compiled stub binary. Used when you have built a custom stub with a non-default feature mask.
DefaultAuto-picks the embedded stub matching the input PE's architecture (x86 / x64 / ARM64).
When to useLeave blank in normal use. Override only when investigating loader behaviour or shipping a custom-trimmed stub.
Example
--stub bin/AkiProtect_stub_x64.exe
--dll-export <name>

For DLL payloads — name of a no-arg export to call after DllMain attach.

What it doesLets you ship a DLL but execute through a named export instead of relying on DllMain alone.
Mutually exclusive with--dll-export-ordinal
Example
--dll-export StartMyApp
--dll-export-ordinal <n>

Same as --dll-export but selects the export by ordinal.

Mutually exclusive with--dll-export
Example
--dll-export-ordinal 1
--report <file>

JSON build / audit report.

What it doesAfter a successful build, writes a JSON file describing every protection bit applied, the chosen stub, tail metadata and integrity hashes.
When to useCI pipelines that need a machine-readable audit trail, or a security team that wants to track exactly what was protected per release.
Example
--report build/audit.json

Compression

Compression shrinks the payload bytes and reshapes the on-disk image. Only one mode active at a time.

--c | --lz77

Classic LZ77 dictionary-based compression.

What it doesStandard LZ77 encoder. The decoder is embedded in the runtime stub and runs before your code starts.
EffectBest compression ratio of the CLI codecs. ~20 ms startup decoder cost on typical hardware.
DefaultOff (no compression).
Mutually exclusive with--lz4
When to useSize-sensitive distribution — downloads, bandwidth-billed channels, app-store packaging.
Example
--lz77
--lz4

LZ4 block-format compression.

What it doesLZ4 is a high-throughput compression codec. Smaller ratio than LZ77 but ~4× faster decoder.
EffectLower compression ratio. ~5 ms startup decoder cost.
DefaultOff.
Mutually exclusive with--lz77
When to useStartup-latency-sensitive applications, GUI apps that need fast cold start, large payloads where decoder time dominates.
Example
--lz4

CLI also exposes --lznt1, --lzms, and --lzma. Prefer --lz4 for speed or --lzma for tightest portable ratio.

Code virtualization

The VM replaces straight-line code with custom bytecode running on a 9-register virtual CPU. Opcode mapping is randomized per build so two copies of the same source execute completely different bytecode.

--vm

Enable one VM transformation pass.

What it doesRuns the payload through one VM transformation: opcodes are remapped using a per-build randomized table, bytecode is appended to the tail along with the opcode map.
EffectDecoder runs at startup before your code. Decoder size: ~3 KB in the stub.
DefaultOff.
Example
--vm
--vm-passes <N>

Apply N independent VM transformations, each with its own opmap.

What it doesStacks N separate VM transformation passes — each pass has its own randomized opcode table. At startup the runtime peels them off in reverse order.
EffectImplies --vm. Protection scales linearly with N; startup overhead scales linearly with N.
Accepted values
  • 1 — single VM pass (same as --vm)
  • 2-4 — strong virtualization, ~20-50 ms extra startup
  • 5-8 — maximum virtualization for sensitive algorithms, ~80-300 ms extra startup
Default1 when --vm is set, otherwise unset.
When to useSet ≥ 4 for algorithms with high IP value: DRM, license enforcement, novel optimization code, anti-cheat hot paths.
Example
--vm-passes 8

Block layout

After encryption, the payload is split into blocks, scattered via a deterministic Ulam-spiral order, and bound with SHA-256 integrity groups. Tampering breaks a group hash and the runtime silently exits.

--ulam-layout

Enable the Ulam-spiral block permutation.

What it doesAdds an Ulam metadata section to the tail describing the spiral order. SHA-256 hashes bind groups of blocks together. At startup the runtime reverses the permutation, verifies every group hash, and only then proceeds to decryption.
EffectActs as the anti-tamper layer. Any modification to the packed file invalidates a SHA-256 group hash and the runtime exits silently.
DefaultOff.
When to useRecommended for all production builds. The runtime cost is small (~5 ms) and the protection is total against bytewise patching.
Example
--ulam-layout
--dump-ulam-map <file>

Debug: export the spiral layout for inspection.

What it doesWrites the chosen Ulam permutation to a file as JSON for verification or debugging.
Requires--ulam-layout
When to useDebug only — never on a production build.
Example
--dump-ulam-map ulam.json

Anti-debug toggles

Six anti-debug probes run at startup. Each is independently togglable so you can switch off a single probe that misfires on a specific customer machine without weakening the other five.

--no-protection

Master kill switch — disable every anti-debug probe at runtime.

What it doesSkips all six anti-debug probes and the staging-encryption check. The encryption layers (compression / VM / Ulam) still apply — only the runtime checks are bypassed.
EffectReduces startup overhead by ~3-5 ms.
When to useDebug your unpack pipeline. Never on a production build.
Example
--no-protection
--no-antidbg-isdbg

Skip IsDebuggerPresent + CheckRemoteDebuggerPresent.

What it doesTwo classic Win32 calls that detect attached debuggers. Trivial to bypass for skilled reversers but stops casual tampering with Visual Studio or x64dbg.
When to useDisable if a customer's legitimate tool (e.g. a profiler) is mistakenly flagged. Otherwise keep enabled.
--no-antidbg-peb

Skip PEB NtGlobalFlag + heap flags scan.

What it doesReads the Process Environment Block directly: NtGlobalFlag at PEB+0x68 and the heap flag values. Bits set there during debugging.
When to useDisable if your customer uses a tool that initializes the heap with debug flags during normal operation.
--no-antidbg-hwbp

Skip Dr0–Dr3 hardware breakpoint scan.

What it doesInspects the four hardware breakpoint registers (Dr0-Dr3) via GetThreadContext. Hardware breakpoints are commonly used by reversers because they don't modify your code.
When to useDisable on systems where another security tool legitimately uses hardware breakpoints (some kernel-level anti-cheat solutions do).
--no-antidbg-rdtsc

Skip RDTSC timing check.

What it doesTimes a tight loop with RDTSC. A debugger single-stepping the loop produces a measurable delay.
When to useDisable on virtualized hosts where the clock can be unreliable (some hypervisors). False positives on heavily loaded shared hosts.
--no-antidbg-exc

Skip OutputDebugString / exception filter trick.

What it doesRaises an exception and uses OutputDebugString to detect behavioural differences between an attached and a detached process.
When to useDisable in environments where a logging or APM agent intercepts OutputDebugString.
--no-antidbg-hide

Skip NtSetInformationThread(ThreadHideFromDebugger).

What it doesCalls NtSetInformationThread with ThreadHideFromDebugger (0x11). Removes the running thread from any debugger's event stream so single-step events stop being delivered.
When to useDisable only if you're actively debugging the protected binary in development.

Hardening (build-time)

Build-time switches that change how the runtime stub is constructed. All four are on by default in the default Release profile.

--no-rand-tail

Use the fixed legacy tail signature.

What it doesDisables the per-build random 8-byte tail signature and reverts to the legacy fixed "TINYLD46" marker.
EffectMakes the file fingerprintable by any AV signature that knows the marker.
DefaultOff — random per-build signature is on.
When to useInternal QA where you need a deterministic file layout for comparison.
--no-bcrypt-keys

Use mt19937 + GetTickCount64 instead of BCryptGenRandom for keys.

What it doesFalls back from the Windows CSPRNG to a software PRNG seeded by the tick counter for all key material (VM opmap permutation, Ulam layout seed, per-stage XOR keys).
EffectDramatically lower entropy. Faster build (no CSPRNG calls).
DefaultOff — BCryptGenRandom is on.
When to useSandboxes without Windows CSPRNG. Never recommended for production.
--classic-stub

Switch to the classic dual stub (visible imports, plain strings).

What it doesReplaces the import-less stealth stub with a classic stub that has standard CRT entry, visible kernel32/user32/psapi imports, and plain string literals.
EffectLarger output. Visible import table. Easier to debug, much easier to fingerprint.
DefaultOff — stealth stub is on.
When to useInvestigating loader issues during initial integration. Production should always use the stealth stub.
--no-staging-enc

Disable inter-stage payload XOR.

What it doesTurns off the per-stage memory XOR that protects the payload buffer between Ulam → VM → LZ decoders. Each transition normally leaves only ciphertext in process memory briefly.
EffectMemory scanners get a window where plaintext payload is visible.
DefaultOff — staging encryption is on.
When to useDebug only.

Diagnostics

Commands that inspect or verify without producing a packed output. Useful in CI gates and pre-flight checks.

--dump-info

Print PE compatibility info for the input and exit.

What it doesInspects the input PE without packing it. Prints architecture, file size, sections, imports, delay imports, and a compatibility verdict.
When to usePre-flight check before adding a new binary to your build pipeline.
Example
AkiProtect_builder.exe --i myapp.exe --dump-info
--explain-unsupported

Print compatibility verdict + reason + suggested action.

What it doesIf the input would be rejected, prints why (e.g. "CLR section detected") and what to change (e.g. "remove managed code or use a different protector").
Example
AkiProtect_builder.exe --i candidate.exe --explain-unsupported
--compat-report <file>

Write JSON compatibility report.

What it doesMachine-readable variant of --explain-unsupported. Includes verdict, reason category, summary, suggested action, plus the full PE diagnostics block.
When to useCI gates that need a structured Yes/No on whether a build will succeed before attempting it.
Example
--compat-report ci/compat.json
--verify-packed <file>

Offline-verify a previously-packed file without running it.

What it doesReads the tail metadata, verifies the integrity hashes (tail hash, VM bytecode hash, payload hash, Ulam group hashes), and prints a verdict.
When to useAfter downloading a build from a release server — confirm it matches the manifest. Or in CI to gate uploads.
Example
AkiProtect_builder.exe --verify-packed dist/myapp_packed.exe
--json <file>

Machine-readable verifier output.

What it doesWhen combined with --verify-packed, writes the verifier's findings as JSON instead of human-readable text.
Example
--verify-packed dist/myapp_packed.exe --json verify.json
--version

Print builder version and tail format version.

What it doesTwo version numbers: the AkiProtect builder version, and the tail format version (incremented on format-breaking changes).
Example
AkiProtect_builder.exe --version