Use when facing packed, virtualized, obfuscated, or licensed binaries, Android packers, IL2CPP/Unreal clients, or encrypted app protocols — before blindly finding OEP, dumping, or keygens. Triggers include Chinese prompts like 加壳、脱壳、VMProtect、Themida、加固、找 OEP、反调试、许可校验、协议加密、是壳还是虚拟机、dump 之后看不懂. Decides packer vs VM vs hardening vs crypto boundary vs license.
