well, i ran caveman through the disassembler in PE-explorer. you can see every string of text, and every system call. so now at least i now what i'm up against. but its kind of cool, i can see what the cracker sees. so i can write my code, disassemble it, and see what it would look like to a cracker.
the next thing to figure out is how to deal with them bypassing the system calls in the VM. i plan to call the vm from time to time to do mundane stuff for the game (like increment action counters). that way if they bypass it entirely, the game won't work. but if they isolate the VM routine, basically a switch(instruction_pointer) routine, then they could turn off or replace the cases for get date, get file date, and read sector. i was thinking maybe a checksum on the vm code in ram, but that might be complicated, what with page access and all, although i know it is done in some types of software.