PasGuard: protecting your Delphi, Free Pascal and Lazarus software against reverse engineering

A compiled Object Pascal application feels like a closed box, but it isn't. With freely available tools, attackers effortlessly extract readable text, function names, embedded keys and business logic from an .exe. For software that checks licences, processes sensitive data or contains valuable intellectual property, that is a real risk. That is why Apptimate developed PasGuard: a tool for Windows executables built with Delphi, Free Pascal and Lazarus that makes your application considerably harder to dissect in a single step.

Now for Free Pascal and Lazarus too

PasGuard started out as a Delphi tool and now supports Free Pascal and Lazarus as well. That means Delphi 7 through 13 and Free Pascal/Lazarus 3.2 and up, for both Win32 and Win64 — without changing a single line of source code. Component names are covered in .dfm and .lfm files alike.

What PasGuard does

PasGuard takes your existing, compiled executable and produces a hardened version. A single step applies several layers of protection:

• Symbol obfuscation — classes, properties, fields, methods and component names are replaced with meaningless identifiers, so the design of your code can no longer be read. Names used through reflection are flagged up front.
• String encryption — string literals are encrypted with a per-build, per-literal keystream and only decrypted at runtime. The decryption stub runs before your application and derives its seed from a checksum of its own code: tampering with it turns your strings into noise rather than exposing them.
• Licence anti-tamper — licences are signed with RSA-2048 and SHA-256, and the embedded public key is tied to the string encryption. A forged licence breaks the application instead of being silently accepted.
• Code signing — as a final step PasGuard runs your signtool automatically, leaving you with an Authenticode-signed build whose origin and integrity users and systems can verify.

Simple to use

PasGuard offers both a graphical interface and a command-line version, so it fits into any build pipeline. A single call is enough to produce a hardened build:

PasGuard.exe -o MyApp.exe --encrypt-strings --encrypt-pubkey

Afterwards, the tool reports exactly what was applied — such as the number of obfuscated identifiers and encrypted text strings — and delivers the hardened build.

Who is PasGuard for?

PasGuard is valuable for anyone distributing standalone Windows software written in Object Pascal: software vendors who want to protect their licensing model, organisations with sensitive logic or keys inside their applications, and developers who want to make reverse engineering and counterfeiting harder. No protection is absolute, but PasGuard raises the bar for an attacker significantly.

Would you like to know how to use PasGuard for your own Delphi, Free Pascal or Lazarus software? Get in touch — we are happy to advise you on protecting your applications. You can read more about the product itself, including the free trial, at pasguard.com.