Guides

Native Virtualization

Configure native protection

Select the native backend, runtime target and method coverage for a local build. Native protection requires a matching runtime for the platform that runs your application.

Configuration

These entries belong in the engine block of your RR configuration.

engine ^ {
  nativeVm.enabled false;
  nativeVm.backend "legacy";
  nativeTarget "windows-x86_64";
}

Select the runtime first

Native options take effect when Native VM is enabled. Prebuilt mode uses an existing runtime. Per-build compilation requires a compatible native compiler toolchain.

Native profiles are not supported by the remote Java worker.

Option reference

Native VM

boolean

nativeVm.enabled

Enables native virtualization. Other native settings remain inactive until this is enabled. Remote Java builds do not support native profiles.

Panel default false

VM backend

enum

nativeVm.backend

Selects Legacy, C or C++ virtualization. The C and C++ selections export as vm.c and vm.cpp.

Panel default legacyValues legacy · vm.c · vm.cpp

Target

string

nativeTarget

Sets the platform on which the protected application will run. Native runtimes must match this target.

Panel default windows-x86_64

Compile mode

enum

nativeCompileMode

Prebuilt uses an existing runtime. Per build requires a compatible native compiler toolchain.

Panel default prebuiltValues prebuilt · per-build-minimal

Automatic method selection

boolean

autoVmProtect

Enables automatic native method selection. Method compatibility checks still apply.

Panel default true

Full native dispatch

boolean

nativeFullDispatch

Enables full dispatch for the selected native backend.

Panel default true

Native control flow

boolean

nativeControlFlow

Enables native control flow transformations independently of Java control flow.

Panel default true

Native flow level

enum

nativeControlFlowLevel

Sets the native flow level from 0 to 3. Requires Native VM.

Panel default 2Values 0 · 1 · 2 · 3

Per method opcode domains

boolean

nativeOpcodeRekey

Uses per-method opcode domains in supported native virtualization paths.

Panel default true

Polymorphic helpers

boolean

nativePolymorphicHelpers

Enables polymorphic generation of supported native helpers.

Panel default true

Inline static closure

boolean

nativeVm.inlineStaticClosure

Includes static closure inlining in the native selection process. Review actual coverage in the build report.

Panel default false

Public methods

boolean

vmProtectPublic

Allows public methods to be considered for native protection. Test public API compatibility.

Panel default false

Private methods

boolean

vmProtectPrivate

Allows private methods to be considered for native protection. Other eligibility checks still apply.

Panel default false

Object allocation

boolean

vmAllowObjectAllocation

Allows supported object allocation operations during native method selection.

Panel default false

Constructor calls

boolean

vmAllowConstructorCalls

Allows supported constructor calls during native method selection.

Panel default false

Instance fields

boolean

vmAllowInstanceFields

Allows supported instance field operations during native method selection.

Panel default false

VM string vault

boolean

nativeVmStringVault

Enables the VM string vault option. This is distinct from Enhanced String Encryption.

Panel default false

Native critical operations

boolean

nativeCriticalOperations

Enables supported native protection for critical operations.

Panel default false

Require selected coverage

boolean

hybridRequireNativeCoverage

Requires the selected native coverage policy. The build can fail when that coverage cannot be achieved.

Panel default false

Fail closed

boolean

privateFailClosed

Stops the build when the required private protection cannot be completed.

Panel default true

Randomize runtime names

boolean

randomizeVmRuntimeNames

Randomizes generated VM runtime names. Keep the runtime and classes from the same build together.

Panel default true

Overhead budget

number

nativeOverheadBudget

Sets the native overhead budget from 0 to 1000. It is a selection budget, not a runtime performance guarantee.

Panel default 40Range 0–1000

Minimum protected methods

number

nativeRequiredMinMethods

Requires at least the specified number of protected methods. Review the build report for actual coverage.

Panel default 0Range 0–100000

Native Virtualization

Configuration

Select the runtime first

Option reference

Related guides