4 ms·

I'm really disappointed this doesn't include technical details, especially the bit about "The game can not run without the token, as it is used to e.g. decrypt

I'm really disappointed this doesn't include technical details, especially the bit about "The game can not run without the token, as it is used to e.g. decrypt certain values at runtime and similar things." Is the game installed encrypted? What encryption schema allows you to decrypt the same set of data using multiple different keys in this way? If the game isn't installed encrypted it seems easiest just to not allow it to encrypt itself before running.

jsheard 3y ago
My vague understanding is that Denuvo generates many redundant diverging paths through the executable, which are chosen at runtime based on pieces of the users hardware signature. The keys you get from the server only work for the paths your hardware is supposed to follow, so if you take those keys to a different machine it will branch in different ways and crash when it's not able to decrypt that path. That redundancy is probably why the protected executables are so large.
- metalcrow 3y ago
  That makes sense, but how are these paths encrypted? If it's at runtime, you should be able to just not encrypt them. If it's at install time, do they generate a custom encrypted exe just for you per-download?
  - jsheard 3y ago
    It's all done ahead of time when the game is packaged by the developer. The executable you download contains every encrypted path that might be executed, but the authentication handshake only gives you the keys for a subset of those.
    - Culonavirus 3y ago
      Hence why a Denuvo protected game exe can easily be hundreds of megs.
    - beeboobaa3 3y ago
      If it were possible to fully sandbox an exe, so that it will always be presented the same hardware/system configuration, would that function as a universal denuvo bypass?
      - CJefferson 3y ago
        From my understanding of looking at denuvo, yes, but at the moment that would require something close to full system emulation -- it's hard to "hide" everything about your 3d hardware in particular, because engines often include different code depending on your exact card, it's GPU power, amount of memory, etc. Emulating a "standard" 3d card would introducing a fairly huge overhead.
        ZiiS 3y ago
        Feels within the cost reward for comercial pirates to activate a few copies of the game across every model of GPU. Full emulation with a GPU passthrough...
    - metalcrow 3y ago
      Ohhh, gotcha! How do they prevent replay attacks? Assuming you were only interested in cracking the game on your specific hardware, could you not just record the decryption key you get and use that offline? Then in theory you could just enumerate every hardware combo and aquire all the keys.

jsheard 3y ago

My vague understanding is that Denuvo generates many redundant diverging paths through the executable, which are chosen at runtime based on pieces of the users hardware signature. The keys you get from the server only work for the paths your hardware is supposed to follow, so if you take those keys to a different machine it will branch in different ways and crash when it's not able to decrypt that path. That redundancy is probably why the protected executables are so large.

metalcrow 3y ago
That makes sense, but how are these paths encrypted? If it's at runtime, you should be able to just not encrypt them. If it's at install time, do they generate a custom encrypted exe just for you per-download?
- jsheard 3y ago
  It's all done ahead of time when the game is packaged by the developer. The executable you download contains every encrypted path that might be executed, but the authentication handshake only gives you the keys for a subset of those.
  - Culonavirus 3y ago
    Hence why a Denuvo protected game exe can easily be hundreds of megs.
  - beeboobaa3 3y ago
    If it were possible to fully sandbox an exe, so that it will always be presented the same hardware/system configuration, would that function as a universal denuvo bypass?
    - CJefferson 3y ago
      From my understanding of looking at denuvo, yes, but at the moment that would require something close to full system emulation -- it's hard to "hide" everything about your 3d hardware in particular, because engines often include different code depending on your exact card, it's GPU power, amount of memory, etc. Emulating a "standard" 3d card would introducing a fairly huge overhead.
      - ZiiS 3y ago
        Feels within the cost reward for comercial pirates to activate a few copies of the game across every model of GPU. Full emulation with a GPU passthrough...
  - metalcrow 3y ago
    Ohhh, gotcha! How do they prevent replay attacks? Assuming you were only interested in cracking the game on your specific hardware, could you not just record the decryption key you get and use that offline? Then in theory you could just enumerate every hardware combo and aquire all the keys.