12 ms·

Denuvo Analysis

322 points by StefanBatory 1y ago

mdaniel 1y ago
I haven't pirated games since I was in highshool, but this nonsense has resulted in the worst UX for games I have paid for - with no recourse on my part. I guess it's like Cloudflare: some people have to suffer because other people don't behave nicely
- alias_neo 1y ago
  I also haven't pirated games since I was a child, but I run Linux, and I game on Linux, whether desktop or on my ROG Ally (Bazzite). The experience for me, when I buy a game, is that I either don't buy one with DRM, or, I buy one that _might_ work, and then I spend a little while trying to get the right version of Proton that runs correctly, and get banned / blocked temporarily for switching my machine identifiers or something too much. It really is a sick joke that the experience for gaming, music and video is all far, far better for those who _don't_ pay than for those who do.
  - Kokouane 1y ago
    > It really is a sick joke that the experience for gaming, music and video is all far, far better for those who _don't_ pay than for those who do. Denuvo is effective enough that if a game has it, it is almost impossible to pirate. So in most cases, it is either pay or do not play the game at all. There was one key player who knew how to crack Denuvo DRM. They went by the name Empress but haven't cracked anything in the past year, and also mentally deranged, often including very transphobic rants in the NFO file of the torrents they release.
    - alias_neo 1y ago
      > it is either pay or do not play the game at all That's still a net win for the pirate I'd argue; for them it's zero steps to "don't play the game at all", for someone like myself it's pay->waste time trying to get it run and fail->refund/no-refund.
      - charcircuit 1y ago
        The wasting of time is because you are using an unsupported operating system. It sounds like if you switched to one you wouldn't have to waste time since the OS would support everything the game needs.
        protimewaster 1y ago
        It feels optimistic to think that the DRM works perfectly on every possible configuration running a supported OS though, does it not?
        kbolino 1y ago
        There is quite a bit of anecdotal evidence that many Denuvo-protected games run worse on the recommended hardware and O/S until the Denuvo protection is removed. The end result is a worse day-one experience for the people who pay the most than for either the pirates (if any) or the people who wait for the game to fall out of the early hype phase.
- josu 1y ago
  >some people have to suffer because other people don't behave nicely It's self fulfilling though. Some people won't behave nicely if a game comes with Denuvo.
- izzydata 1y ago
  What part of the experience suffers from Denuvo? I've had games with Denuvo and then had Denuvo removed and at least in my limited personal experience there has been no discernible difference. I can understand the argument against DRM in general and owning things you buy, but that seems like a different problem.
  - RedCardRef 1y ago
    https://youtu.be/07NMuobVVwQ?si=6X_uZQoK11ZJcebI https://youtu.be/07NMuobVVwQ?si=6X_uZQoK11ZJcebI https://youtu.be/1VpWKwIjwLk?si=JxjXuhJJAutXp1ww https://youtu.be/1VpWKwIjwLk?si=JxjXuhJJAutXp1ww
    - izzydata 1y ago
      Interesting. For how effective Denuvo is the impact is negligible. Less than 1% average framerate and seconds of loading time. The disk space usage is weird, but 100mb to 300mb executables is irrelevant in the age of terabyte drives and 50gb game installs. Nice to confirm that there was no way I was ever going to notice its impact.
      - nneonneo 1y ago
        The clever thing here is that Denuvo is only used to protect certain functions, not the entire game. The functions it protects should be functions that run infrequently, but contain enough critical game logic that they can’t just be replaced wholesale by a cracker. I believe the game developer themselves chooses what functions to protect. If they protect too much (or protect the wrong functions) performance can suffer, whereas if they don’t protect enough, the crackers’ job is too easy.
        izzydata 1y ago
        I wonder if Denuvo the company charges more or less depending on how much function protection the developer chooses or if it is a flat rate.
- onli 1y ago
  Just in case that's helpful, there is a Steam curator that marks games protected with Denuvo, to make that fact more visible before you buy them. https://store.steampowered.com/curator/26095454-Denuvo-Watch/ https://store.steampowered.com/curator/26095454-Denuvo-Watch...
tristor 1y ago
Very interesting analysis and as someone who practiced reversing/cracking in my youth, it helps me to understand why Denuvo is so effective. I have, for awhile, had a policy that I will not buy any game with Denuvo, and I continue to stand by that policy. I only play games w/ Steam on Linux (Steam Deck or Framework 13 laptop) and Denuvo makes this impossible, so it's a hard no from me. But I respect the engineering they invested into this DRM.
- xienze 1y ago
  > I only play games w/ Steam on Linux (Steam Deck or Framework 13 laptop) and Denuvo makes this impossible Are you sure about that? I have a ROG Ally running Bazzite and I have played several games on this page[0] that use Denuvo. 0: https://store.steampowered.com/curator/26095454-Denuvo-Watch/ https://store.steampowered.com/curator/26095454-Denuvo-Watch...
- akimbostrawman 1y ago
  Denuvo DRM works on linux however it does require an internet connection and you can get banned for +24 hours if you play on more than 3-5 devices a day (a proton prefix also counts as 1 device).
  - mort96 1y ago
    Yeah I remember trying to debug some issue I had with DOOM Eternal (I think) and then randomly getting the message that I can't play for 24 hours because I'm an evil criminal. Not a great customer experience.
- andoando 1y ago
  I mean why shouldn't game developers protect their game from piracy?
  - yjftsjthsd-h 1y ago
    Because it punishes legitimate users
  - 1y ago
cainxinth 1y ago
Lets see Empress's analysis
- Culonavirus 1y ago
  Heh... Now that would be the fastest flag in the history of this site.
  - efilife 1y ago
    why?
    - mschuster91 1y ago
      Empress made a name for themselves not just with cracking Denuvo but for going on full blown transphobic rants in their NFOs such as in the Hogwarts Legacy crack [1]. [1] https://www.reddit.com/r/Asmongold/comments/119x8ht/heres_empresss_rant_when_she_cracked_hogwarts_its/#lightbox https://www.reddit.com/r/Asmongold/comments/119x8ht/heres_em...
      - efilife 1y ago
        ironic
      - deleted 1y ago
        [deleted]
      - jaoane 1y ago
        [flagged]
    - ReptileMan 1y ago
      She is as unstable as she is talented.
farmdve 1y ago
What isn't mentioned in the article is why UD2 is chosen. It is a relic from the SecuROM days, in fact, one of the developers on SecuROM is the one who also works or worked at Denuvo. I would imagine many things from the SecuROM era live on in Denuvo. But if you read the article you will realize that certain games will not work in the future due to Denuvo. "This destroyed any exception-based hooking since majority of the time an exception is triggered, Windows will write an EXCEPTION_RECORD high up in unused stack space. You can probably see where this is going. Now, whenever the CPUID is hooked via an exception, that important value will become overwritten with an EXCEPTION_RECORD, causing undefined behaviour later on. I believe this can be bypassed if you attach a debugger to the process and set certain flags when it comes to exception handling, but the method of patching every hardware check is still cumbersome due to randomness anyway." As Windows matures, behaviour can change, breaking certain stuff.
- musjleman 1y ago
  > As Windows matures, behaviour can change, breaking certain stuff. How do you expect the aforementioned tech to break the games it's on? If anything it "breaking" will just make the anti-tamper feature ineffective.
  - ainiriand 1y ago
    I imagine that if some Denuvo servers enter legacy status at some point they'll be removed entirely.
    - sbarre 1y ago
      Yeah it's not uncommon to see Denuvo patched out of a game title once the initial sales window has passed.. I wonder if that's because they want to avoid these kinds of future incompatiblities with the underlying OS as it evolves.
      - transcriptase 1y ago
        IIRC Denuvo costs a fortune to keep in a game, since it’s a subscription model. Once sales sufficiently taper off there’s not much sense in paying for it anymore.
flerchin 1y ago
I'm confused by calling the identifying information "stolen constants" or "stolen instructions". I don't understand why it's considered stolen. Do we mean "intercepted"?
- nneonneo 1y ago
  The “stolen” constants/instructions are bits of code that were in the original (VM-obfuscated) binary. These constants/instructions are deleted from the binary and provided by the server in an obfuscated form. Effectively, the binary you get when buying the game is incomplete: you get a dynamic, encrypted, system-dependent patch from the server that supplies the missing pieces (the “stolen” pieces).
- mpeg 1y ago
  It's a very common term in reverse engineering, and low level programming in general. In VMs you usually say "stolen" to refer to bytes/instructions/constants that have been taken from the original binary and put somewhere else (whether obfuscated or not, whether still in the local binary or in a server like with denuvo)
rjh29 1y ago
It is clearly effective. Go to a PC game piracy site and most games will be available, but anything covered by Denuvo is unavailable even years later. Either nobody is willing to crack it (unlikely) or Denuvo have done an exceptional job.
- devmor 1y ago
  To some degree this is true, but it's cost-benefit analysis rather than being uncrackable. Denuvo is so invasive that software exploits aren't worth the effort (or risk on behalf of the user), and physical exploits are sold instead. For example, physical FPS exploits include devices that sit in the HDMI/DP chain with a USB output and emulate a keyboard and mouse.
- clayhacks 1y ago
  There’s definitely been plenty of denuvo games cracked, but I’d say most games that haven’t been cracked have denuvo. I think it also depends on the version of denuvo. Newer versions seem pretty well protected
- 0cf8612b2e1e 1y ago
  Could some of that be the decreasing share of single player games? Multiplayer, always online games are a moving target vs an offline game you only need to crack once. Everything “needs” to be online, user experience be damned.
- sph 1y ago
  There are cracked Denuvo games, and no anti-piracy scheme is unbreakable, ever. If it can run on your PC when copy-protected, it means at some point the CPU executed the right instructions, so a crack is always possible to create. It's just a matter of how much effort and time is it to reverse-engineer it. You cannot copy-protect software indefinitely. I remember feeling cool as fuck as a teenager because I cracked GTA 3 by dumping the live memory of the binary post decryption. Of course it's been 25 years, so the status quo has improved by a lot and god knows how many man-years and kWh are wasted on copy protection.
  - 1y ago
StefanBatory 1y ago
Also unrelated, but seeing "A 2nd Year Computer Science Student" in the blog name was both breathtaking in a positive way, but also hurts a little. Kudos to the author, seriously.
- mpeg 1y ago
  Students are the only people with the patience for deep RE, I spent hours and hours in my teens unpacking binaries that used similar VMs and got pretty decent at it. Nowadays, there is no way I could do it, I tried to get back into hackthebox recently and the new RE challenges make my brain hurt.
doctorpangloss 1y ago
Game developers have Denuvo as an anti-piracy option. This is your choice for single player PC games. There’s also multiplayer as anti piracy. It is impracticable to spoof unseen, complex server code forever. Environment Integrity is the most flexible. That means you can’t pirate because you can’t sideload code that doesn’t belong to you, and that a remote license check cannot be spoofed. The environment also has to provide enough incremental value in updates that most people will keep auto-update on. Although, of course, Apple could force updates. To me, the problem is how to avoid this conversation altogether. The kind of person who has the personality defect that makes him post rants about DRM doesn’t listen long enough to figure out “validity” in games. Like imagine when people invoke that word, “valid.” This is what DRM is about to audiences, not technology. Video games are aesthetic experiences, you don’t have to play them to survive, to me it is valid to consider anything related to the game, like its DRM or the development team or whatever, as fair game for “valid.” But. If you don’t think Denuvo is valid, you don’t think “AAA single player games on PC” is valid. And maybe that’s okay, maybe you can only go to iOS or the Switch or PS5 (Environment Integrity DRM) for AAA single player. There are no indie developers on consoles, so suddenly, you are also saying, “the only place for single player that costs money to make for self published is iOS.” This is why I personally find the crusade against Denuvo so ironic: the people who could take the biggest creative risks and reap the most reward, including the right to keep making whatever it is they want, benefit the most from Denuvo.
- keyringlight 1y ago
  One thing I try to bear in mind with this is while there's a lot of anti-corporate discussion alongside video games, they're quite often contrary to what happens in the wider world when you compare against what games or companies are successful. A lot of it skirts around the concept that developers big or small take money to be made and don't seem to have a good idea on how success should be rewarded (or differing rules depending on who you are). The video game audience is also going to be incredibly broad across a huge range of circumstances around the globe, so the question of what something is worth will have a wide range too.
  - deleted 1y ago
    [deleted]
Traubenfuchs 1y ago
What happened to the empress? Is she (he?) still schizoposting via homophobic and transphobic .nfo files, combining super natural female moon goddess intuition with deep rooted cracking knowledge and has a growing telegram community full of G*mer simps? For those not in the know, empress is/was THE famous denuvo cracker with a rather... eccentric online presentation of themself.
- davikr 1y ago
  empress went dark after being exposed by a scene group as "voksi, the bulgarian". no one knows, but it did coincide with that.
  - dartharva 1y ago
    Voksi was a popular cracker and among the first to face against Denuvo in the early days. He got himself arrested because apparently his opsec was so nonexistent he used to lurk in steam using his real name and upload cracking tutorials on youtube. Nobody knows what happened after, or whether he reached a deal with Denuvo or anything else. But Empress did arrive some time after he got arrested, so it could be speculated. He has denied it himself however, on multiple occasions, but even if he is Empress it's obviously something you won't expect him to admit after all that's happened.
menthe 1y ago
Nothing a well-trained model won't be able to instantly solve. It's literally just grunt work, not rocket science. F DRMs though. Good news is those AAA games are rarely worth anyone's time anyways. Better spin up indies or classic games - a good SNES game is worth a hundred of those garbo AAA license rehashes.
- ainiriand 1y ago
  Not for normies.
- formerly_proven 1y ago
  It’s hard to overstate how poor the technical quality of modern games is. Pretty much every DX12/Raytracing title is just a stuttering mess with absurd shader compilation and traversal stutter. Nevermind ridiculous ghosting artifacts and the like produced by Lumen. Modern games are optimized to look good on screenshots and not-realtime in-engine renders for trailers. Hardware and APIs have never been more powerful, and engine developers turn out the worst-running games since 30 fps hardlocked Xbox ports from the 2000s.
- andrewmcwatters 1y ago
  I can't stress enough how much this is not true for any meaningful production threat detection software. Models regularly fail reversing even basic obfuscation tasks. Try it yourself. No, ChatGPT is not going to break Denuvo. Probably not even in OpenAI's wildest dreams. Generating an image or sound is seemingly child's play compared to actual complex software tasks. There's not 1,000 different open source DRM codebases you can train against. It's not a diverse field. Generating code to do script kiddie hooking? Sure. Reversing a complex multi-tiered obfuscation and trust platform? Yeah, right.
- mort96 1y ago
  Source?
yukIttEft 1y ago
Had also a look at Denuvo a while ago. Used LLVM to remove the x86 obfuscation and broke it down to VM-Opcodes. Atleast back then, Denuvo seemd to translate gamecode into a stackmachine. This is how a VM push looks like: temp[0]=add(mem[e268], fffffffffffffff8) mem[temp[0]]]=mem[e560] mem[e268]=temp[0] (vmreg_e268 is stackpointer, its decremented and stored in tempreg, then the value of vmreg_e560 is copied to stackpointeraddr, then new stackpointervalue is written back) But i quickly lost interest when it became MBA galore: temp[7]=sub(add(add(and(mem[ebe8], b2f7), 3fd8), xor(lshr(mem[ebe8], 1), 2684)), lshr(add(mem[ebe8], b2f8), 1)) temp[d]=or(sub(sub(4ad, temp[7]), xor(and(shl(temp[7], 1), 95c), 95c)), 8000) temp[e]=lshr(temp[d], 1) temp[11]=lshr(add(temp[d], 8001), 1) mem[ebe8]=sub(xor(xor(temp[e], 3fff), temp[11]), shl(and(and(temp[e], 3fff), temp[11]), 1)) (looks like its doing some operation with a constant to vmreg_ebe8, but obfuscated by MBAs and most likely the result won't ever being used, so its just noise to drown out the real operations) BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ?
- jcranmer 1y ago
  > BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ? Your best bet is InstCombine, but likely most of the MBA patterns aren't going to be InstCombine patterns because who writes that kind of code? In principle, you might see if you can tickle Alive2 (which can map LLVM IR to SMT logic) to see if you can get a peephole optimizer that's querying an SMT solver. But I'm not aware of anyone who's built a pass like that yet, and it's definitely not a regular pass in the compiler.
  - yukIttEft 1y ago
    Wasn't aware of Alive2. Thx, I'll have look. I had some success with https://github.com/mrphrazer/msynth https://github.com/mrphrazer/msynth But its hard to glue this to LLVM.
- jor-el 1y ago
  You can take a look at SiMBA++ -> https://github.com/pgarba/SiMBA- https://github.com/pgarba/SiMBA- It is a C++ implementation of SiMBA [1] - a tool to handle linear MBAs, made available by Denuvo itself. Denuvo have another tool - Gamba for handling some variety of non-linear MBAs. And then further improvisation by another researcher - MSiMBA [3]. SiMBA++ since written in C++, it is fast and it integrates well into the LLVM passes to automatically identify the MBAs and replace them in the LLVM IR with simplified expressions. So no additional work required. Shameless plug - me and my colleague (author of SiMBA++) recently gave a talk about using LLVM for deobfuscation of WASM, where we talk about MBAs, SiMBA++ etc. The idea is not limited to WASM, it is language agnostic once you have a binary lifted to LLVM IR. https://www.youtube.com/watch?v=gKRdOcuXbYI https://www.youtube.com/watch?v=gKRdOcuXbYI [1] SiMBA - https://github.com/DenuvoSoftwareSolutions/SiMBA https://github.com/DenuvoSoftwareSolutions/SiMBA [2] Gamba - https://github.com/DenuvoSoftwareSolutions/GAMBA https://github.com/DenuvoSoftwareSolutions/GAMBA [3] MSiMBA - https://github.com/mazeworks-security/MSiMBA https://github.com/mazeworks-security/MSiMBA
2c2c2c 1y ago
years ago, a friend of mine built something functionally equivalent to Denuvo in his spare time over the span of a few years. I think his original idea was "DRM for the little guy", recognizing that indie games probably lose massive revenue from initial release piracy. He had no idea how to sell it. After it sitting around for awhile, I tried pitching the technology to few friends in VC, who had absolutely no idea what I was talking about. It bothered me for a long time to see such a culmination of talent and effort get 0 reward for it. I've wondered if such technology would be interesting to some large publisher to just buy outright, bringing their anti-piracy in-house rather than relying on Denuvo. Any ideas/help appreciated :)
- HighGoldstein 1y ago
  > recognizing that indie games probably lose massive revenue from initial release piracy. This seems like an odd claim _especially_ for indie games. Indie games tend to already have trouble attracting buyers, it feels like anyone considering pirating it would just move on if they couldn't do so.
  - 2c2c2c 1y ago
    Can't say I was sold with the target market mostly because the sales problem becomes orders of magnitude harder My thought regarding indie games were successful ones though. Something like Celeste or Balatro.
    - ronsor 1y ago
      I pay for games because it's convenient. Most DRM is decidedly inconvenient for me, especially Denuvo-tier DRM. The end result is that if there's DRM, I'm more likely to pirate it or not play it if there's no crack.
      - gruez 1y ago
        How's denuvo "inconvenient"? For the overwhelming majority of people, it just works and they don't even know it's there.
shmerl 1y ago
Vote with your wallet and don't buy games with this junk.
- LightHugger 1y ago
  Worth noting that denuvo causes a lot of hitching, massive load time increases and overall performance problems. Denuvo marketing dept likes to say this isn't true but you only have to look at the before/after on games with and without it, monster hunter world was a very stark example. I have no doubt denuvo is also massively contributing to the performance problems on Monster Hunter Wilds as well.
  - shmerl 1y ago
    Of course. DRM can never improve user experience, it's an anti-user feature by definition.
    - Tadpole9181 1y ago
      Not going to take sides on the particular debate, but one could certainly argue that DRM is just a double-edge blade. The world is less fun with less art and games. And those require money to be made. The cost of securing that or making legitimate purchases cheaper (broadening the legal market) may be the initial online requirement and potential performance impacts. Again, I'm not saying Denuvo is or is not a net in one way or the other. Just that there is room for gray.
      - account42 1y ago
        There are plenty of commercial games that make the development costs back without any use of DRM. Also, art and games don't require money to be made. And I'd also argue that we don't actually need more games since we already have many - getting more is nice but we don't have to throw away our principles for it.
    - billmcneale 1y ago
      > it's an anti-user feature by definition. That's an extremely naive take that shows some stark ignorance of the tech and market forces at work. From a tech standpoint, Denuvo negatively impacting performance has been debunked many times over (see my previous post about that). On the economical side, you need to realize that whenever you are playing and enjoying a game, it's most likely due to the fact that the previous games sold by that developer have been successful in making money, which was most likely made possible by Denuvo. In other words, making piracy harder allows the next generation of games to be created.
larodi 1y ago
ph34r! op is top
hoseja 1y ago
Buy from GoG and indies Don't play AAA slop

322 points by StefanBatory 1y ago

I haven't pirated games since I was in highshool, but this nonsense has resulted in the worst UX for games I have paid for - with no recourse on my part. I guess it's like Cloudflare: some people have to suffer because other people don't behave nicely

alias_neo 1y ago
I also haven't pirated games since I was a child, but I run Linux, and I game on Linux, whether desktop or on my ROG Ally (Bazzite). The experience for me, when I buy a game, is that I either don't buy one with DRM, or, I buy one that _might_ work, and then I spend a little while trying to get the right version of Proton that runs correctly, and get banned / blocked temporarily for switching my machine identifiers or something too much. It really is a sick joke that the experience for gaming, music and video is all far, far better for those who _don't_ pay than for those who do.
- Kokouane 1y ago
  > It really is a sick joke that the experience for gaming, music and video is all far, far better for those who _don't_ pay than for those who do. Denuvo is effective enough that if a game has it, it is almost impossible to pirate. So in most cases, it is either pay or do not play the game at all. There was one key player who knew how to crack Denuvo DRM. They went by the name Empress but haven't cracked anything in the past year, and also mentally deranged, often including very transphobic rants in the NFO file of the torrents they release.
  - alias_neo 1y ago
    > it is either pay or do not play the game at all That's still a net win for the pirate I'd argue; for them it's zero steps to "don't play the game at all", for someone like myself it's pay->waste time trying to get it run and fail->refund/no-refund.
    - charcircuit 1y ago
      The wasting of time is because you are using an unsupported operating system. It sounds like if you switched to one you wouldn't have to waste time since the OS would support everything the game needs.
      - protimewaster 1y ago
        It feels optimistic to think that the DRM works perfectly on every possible configuration running a supported OS though, does it not?
      - kbolino 1y ago
        There is quite a bit of anecdotal evidence that many Denuvo-protected games run worse on the recommended hardware and O/S until the Denuvo protection is removed. The end result is a worse day-one experience for the people who pay the most than for either the pirates (if any) or the people who wait for the game to fall out of the early hype phase.
josu 1y ago
>some people have to suffer because other people don't behave nicely It's self fulfilling though. Some people won't behave nicely if a game comes with Denuvo.
izzydata 1y ago
What part of the experience suffers from Denuvo? I've had games with Denuvo and then had Denuvo removed and at least in my limited personal experience there has been no discernible difference. I can understand the argument against DRM in general and owning things you buy, but that seems like a different problem.
- RedCardRef 1y ago
  https://youtu.be/07NMuobVVwQ?si=6X_uZQoK11ZJcebI https://youtu.be/07NMuobVVwQ?si=6X_uZQoK11ZJcebI https://youtu.be/1VpWKwIjwLk?si=JxjXuhJJAutXp1ww https://youtu.be/1VpWKwIjwLk?si=JxjXuhJJAutXp1ww
  - izzydata 1y ago
    Interesting. For how effective Denuvo is the impact is negligible. Less than 1% average framerate and seconds of loading time. The disk space usage is weird, but 100mb to 300mb executables is irrelevant in the age of terabyte drives and 50gb game installs. Nice to confirm that there was no way I was ever going to notice its impact.
    - nneonneo 1y ago
      The clever thing here is that Denuvo is only used to protect certain functions, not the entire game. The functions it protects should be functions that run infrequently, but contain enough critical game logic that they can’t just be replaced wholesale by a cracker. I believe the game developer themselves chooses what functions to protect. If they protect too much (or protect the wrong functions) performance can suffer, whereas if they don’t protect enough, the crackers’ job is too easy.
      - izzydata 1y ago
        I wonder if Denuvo the company charges more or less depending on how much function protection the developer chooses or if it is a flat rate.
onli 1y ago
Just in case that's helpful, there is a Steam curator that marks games protected with Denuvo, to make that fact more visible before you buy them. https://store.steampowered.com/curator/26095454-Denuvo-Watch/ https://store.steampowered.com/curator/26095454-Denuvo-Watch...

tristor 1y ago

Very interesting analysis and as someone who practiced reversing/cracking in my youth, it helps me to understand why Denuvo is so effective. I have, for awhile, had a policy that I will not buy any game with Denuvo, and I continue to stand by that policy. I only play games w/ Steam on Linux (Steam Deck or Framework 13 laptop) and Denuvo makes this impossible, so it's a hard no from me. But I respect the engineering they invested into this DRM.

xienze 1y ago
> I only play games w/ Steam on Linux (Steam Deck or Framework 13 laptop) and Denuvo makes this impossible Are you sure about that? I have a ROG Ally running Bazzite and I have played several games on this page[0] that use Denuvo. 0: https://store.steampowered.com/curator/26095454-Denuvo-Watch/ https://store.steampowered.com/curator/26095454-Denuvo-Watch...
akimbostrawman 1y ago
Denuvo DRM works on linux however it does require an internet connection and you can get banned for +24 hours if you play on more than 3-5 devices a day (a proton prefix also counts as 1 device).
- mort96 1y ago
  Yeah I remember trying to debug some issue I had with DOOM Eternal (I think) and then randomly getting the message that I can't play for 24 hours because I'm an evil criminal. Not a great customer experience.
andoando 1y ago
I mean why shouldn't game developers protect their game from piracy?
- yjftsjthsd-h 1y ago
  Because it punishes legitimate users
- 1y ago

cainxinth 1y ago

Lets see Empress's analysis

Culonavirus 1y ago
Heh... Now that would be the fastest flag in the history of this site.
- efilife 1y ago
  why?
  - mschuster91 1y ago
    Empress made a name for themselves not just with cracking Denuvo but for going on full blown transphobic rants in their NFOs such as in the Hogwarts Legacy crack [1]. [1] https://www.reddit.com/r/Asmongold/comments/119x8ht/heres_empresss_rant_when_she_cracked_hogwarts_its/#lightbox https://www.reddit.com/r/Asmongold/comments/119x8ht/heres_em...
    - efilife 1y ago
      ironic
    - deleted 1y ago
      [deleted]
    - jaoane 1y ago
      [flagged]
  - ReptileMan 1y ago
    She is as unstable as she is talented.

farmdve 1y ago

What isn't mentioned in the article is why UD2 is chosen. It is a relic from the SecuROM days, in fact, one of the developers on SecuROM is the one who also works or worked at Denuvo. I would imagine many things from the SecuROM era live on in Denuvo. But if you read the article you will realize that certain games will not work in the future due to Denuvo. "This destroyed any exception-based hooking since majority of the time an exception is triggered, Windows will write an EXCEPTION_RECORD high up in unused stack space. You can probably see where this is going. Now, whenever the CPUID is hooked via an exception, that important value will become overwritten with an EXCEPTION_RECORD, causing undefined behaviour later on. I believe this can be bypassed if you attach a debugger to the process and set certain flags when it comes to exception handling, but the method of patching every hardware check is still cumbersome due to randomness anyway." As Windows matures, behaviour can change, breaking certain stuff.

musjleman 1y ago
> As Windows matures, behaviour can change, breaking certain stuff. How do you expect the aforementioned tech to break the games it's on? If anything it "breaking" will just make the anti-tamper feature ineffective.
- ainiriand 1y ago
  I imagine that if some Denuvo servers enter legacy status at some point they'll be removed entirely.
  - sbarre 1y ago
    Yeah it's not uncommon to see Denuvo patched out of a game title once the initial sales window has passed.. I wonder if that's because they want to avoid these kinds of future incompatiblities with the underlying OS as it evolves.
    - transcriptase 1y ago
      IIRC Denuvo costs a fortune to keep in a game, since it’s a subscription model. Once sales sufficiently taper off there’s not much sense in paying for it anymore.

flerchin 1y ago

I'm confused by calling the identifying information "stolen constants" or "stolen instructions". I don't understand why it's considered stolen. Do we mean "intercepted"?

nneonneo 1y ago
The “stolen” constants/instructions are bits of code that were in the original (VM-obfuscated) binary. These constants/instructions are deleted from the binary and provided by the server in an obfuscated form. Effectively, the binary you get when buying the game is incomplete: you get a dynamic, encrypted, system-dependent patch from the server that supplies the missing pieces (the “stolen” pieces).
mpeg 1y ago
It's a very common term in reverse engineering, and low level programming in general. In VMs you usually say "stolen" to refer to bytes/instructions/constants that have been taken from the original binary and put somewhere else (whether obfuscated or not, whether still in the local binary or in a server like with denuvo)

rjh29 1y ago

It is clearly effective. Go to a PC game piracy site and most games will be available, but anything covered by Denuvo is unavailable even years later. Either nobody is willing to crack it (unlikely) or Denuvo have done an exceptional job.

devmor 1y ago
To some degree this is true, but it's cost-benefit analysis rather than being uncrackable. Denuvo is so invasive that software exploits aren't worth the effort (or risk on behalf of the user), and physical exploits are sold instead. For example, physical FPS exploits include devices that sit in the HDMI/DP chain with a USB output and emulate a keyboard and mouse.
clayhacks 1y ago
There’s definitely been plenty of denuvo games cracked, but I’d say most games that haven’t been cracked have denuvo. I think it also depends on the version of denuvo. Newer versions seem pretty well protected
0cf8612b2e1e 1y ago
Could some of that be the decreasing share of single player games? Multiplayer, always online games are a moving target vs an offline game you only need to crack once. Everything “needs” to be online, user experience be damned.
sph 1y ago
There are cracked Denuvo games, and no anti-piracy scheme is unbreakable, ever. If it can run on your PC when copy-protected, it means at some point the CPU executed the right instructions, so a crack is always possible to create. It's just a matter of how much effort and time is it to reverse-engineer it. You cannot copy-protect software indefinitely. I remember feeling cool as fuck as a teenager because I cracked GTA 3 by dumping the live memory of the binary post decryption. Of course it's been 25 years, so the status quo has improved by a lot and god knows how many man-years and kWh are wasted on copy protection.
- 1y ago

StefanBatory 1y ago

Also unrelated, but seeing "A 2nd Year Computer Science Student" in the blog name was both breathtaking in a positive way, but also hurts a little. Kudos to the author, seriously.

mpeg 1y ago
Students are the only people with the patience for deep RE, I spent hours and hours in my teens unpacking binaries that used similar VMs and got pretty decent at it. Nowadays, there is no way I could do it, I tried to get back into hackthebox recently and the new RE challenges make my brain hurt.

doctorpangloss 1y ago

Game developers have Denuvo as an anti-piracy option. This is your choice for single player PC games. There’s also multiplayer as anti piracy. It is impracticable to spoof unseen, complex server code forever. Environment Integrity is the most flexible. That means you can’t pirate because you can’t sideload code that doesn’t belong to you, and that a remote license check cannot be spoofed. The environment also has to provide enough incremental value in updates that most people will keep auto-update on. Although, of course, Apple could force updates. To me, the problem is how to avoid this conversation altogether. The kind of person who has the personality defect that makes him post rants about DRM doesn’t listen long enough to figure out “validity” in games. Like imagine when people invoke that word, “valid.” This is what DRM is about to audiences, not technology. Video games are aesthetic experiences, you don’t have to play them to survive, to me it is valid to consider anything related to the game, like its DRM or the development team or whatever, as fair game for “valid.” But. If you don’t think Denuvo is valid, you don’t think “AAA single player games on PC” is valid. And maybe that’s okay, maybe you can only go to iOS or the Switch or PS5 (Environment Integrity DRM) for AAA single player. There are no indie developers on consoles, so suddenly, you are also saying, “the only place for single player that costs money to make for self published is iOS.” This is why I personally find the crusade against Denuvo so ironic: the people who could take the biggest creative risks and reap the most reward, including the right to keep making whatever it is they want, benefit the most from Denuvo.

keyringlight 1y ago
One thing I try to bear in mind with this is while there's a lot of anti-corporate discussion alongside video games, they're quite often contrary to what happens in the wider world when you compare against what games or companies are successful. A lot of it skirts around the concept that developers big or small take money to be made and don't seem to have a good idea on how success should be rewarded (or differing rules depending on who you are). The video game audience is also going to be incredibly broad across a huge range of circumstances around the globe, so the question of what something is worth will have a wide range too.
- deleted 1y ago
  [deleted]

Traubenfuchs 1y ago

What happened to the empress? Is she (he?) still schizoposting via homophobic and transphobic .nfo files, combining super natural female moon goddess intuition with deep rooted cracking knowledge and has a growing telegram community full of G*mer simps? For those not in the know, empress is/was THE famous denuvo cracker with a rather... eccentric online presentation of themself.

davikr 1y ago
empress went dark after being exposed by a scene group as "voksi, the bulgarian". no one knows, but it did coincide with that.
- dartharva 1y ago
  Voksi was a popular cracker and among the first to face against Denuvo in the early days. He got himself arrested because apparently his opsec was so nonexistent he used to lurk in steam using his real name and upload cracking tutorials on youtube. Nobody knows what happened after, or whether he reached a deal with Denuvo or anything else. But Empress did arrive some time after he got arrested, so it could be speculated. He has denied it himself however, on multiple occasions, but even if he is Empress it's obviously something you won't expect him to admit after all that's happened.

menthe 1y ago

Nothing a well-trained model won't be able to instantly solve. It's literally just grunt work, not rocket science. F DRMs though. Good news is those AAA games are rarely worth anyone's time anyways. Better spin up indies or classic games - a good SNES game is worth a hundred of those garbo AAA license rehashes.

ainiriand 1y ago
Not for normies.
formerly_proven 1y ago
It’s hard to overstate how poor the technical quality of modern games is. Pretty much every DX12/Raytracing title is just a stuttering mess with absurd shader compilation and traversal stutter. Nevermind ridiculous ghosting artifacts and the like produced by Lumen. Modern games are optimized to look good on screenshots and not-realtime in-engine renders for trailers. Hardware and APIs have never been more powerful, and engine developers turn out the worst-running games since 30 fps hardlocked Xbox ports from the 2000s.
andrewmcwatters 1y ago
I can't stress enough how much this is not true for any meaningful production threat detection software. Models regularly fail reversing even basic obfuscation tasks. Try it yourself. No, ChatGPT is not going to break Denuvo. Probably not even in OpenAI's wildest dreams. Generating an image or sound is seemingly child's play compared to actual complex software tasks. There's not 1,000 different open source DRM codebases you can train against. It's not a diverse field. Generating code to do script kiddie hooking? Sure. Reversing a complex multi-tiered obfuscation and trust platform? Yeah, right.
mort96 1y ago
Source?

yukIttEft 1y ago

Had also a look at Denuvo a while ago. Used LLVM to remove the x86 obfuscation and broke it down to VM-Opcodes. Atleast back then, Denuvo seemd to translate gamecode into a stackmachine. This is how a VM push looks like: temp[0]=add(mem[e268], fffffffffffffff8) mem[temp[0]]]=mem[e560] mem[e268]=temp[0] (vmreg_e268 is stackpointer, its decremented and stored in tempreg, then the value of vmreg_e560 is copied to stackpointeraddr, then new stackpointervalue is written back) But i quickly lost interest when it became MBA galore: temp[7]=sub(add(add(and(mem[ebe8], b2f7), 3fd8), xor(lshr(mem[ebe8], 1), 2684)), lshr(add(mem[ebe8], b2f8), 1)) temp[d]=or(sub(sub(4ad, temp[7]), xor(and(shl(temp[7], 1), 95c), 95c)), 8000) temp[e]=lshr(temp[d], 1) temp[11]=lshr(add(temp[d], 8001), 1) mem[ebe8]=sub(xor(xor(temp[e], 3fff), temp[11]), shl(and(and(temp[e], 3fff), temp[11]), 1)) (looks like its doing some operation with a constant to vmreg_ebe8, but obfuscated by MBAs and most likely the result won't ever being used, so its just noise to drown out the real operations) BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ?

jcranmer 1y ago
> BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ? Your best bet is InstCombine, but likely most of the MBA patterns aren't going to be InstCombine patterns because who writes that kind of code? In principle, you might see if you can tickle Alive2 (which can map LLVM IR to SMT logic) to see if you can get a peephole optimizer that's querying an SMT solver. But I'm not aware of anyone who's built a pass like that yet, and it's definitely not a regular pass in the compiler.
- yukIttEft 1y ago
  Wasn't aware of Alive2. Thx, I'll have look. I had some success with https://github.com/mrphrazer/msynth https://github.com/mrphrazer/msynth But its hard to glue this to LLVM.
jor-el 1y ago
You can take a look at SiMBA++ -> https://github.com/pgarba/SiMBA- https://github.com/pgarba/SiMBA- It is a C++ implementation of SiMBA [1] - a tool to handle linear MBAs, made available by Denuvo itself. Denuvo have another tool - Gamba for handling some variety of non-linear MBAs. And then further improvisation by another researcher - MSiMBA [3]. SiMBA++ since written in C++, it is fast and it integrates well into the LLVM passes to automatically identify the MBAs and replace them in the LLVM IR with simplified expressions. So no additional work required. Shameless plug - me and my colleague (author of SiMBA++) recently gave a talk about using LLVM for deobfuscation of WASM, where we talk about MBAs, SiMBA++ etc. The idea is not limited to WASM, it is language agnostic once you have a binary lifted to LLVM IR. https://www.youtube.com/watch?v=gKRdOcuXbYI https://www.youtube.com/watch?v=gKRdOcuXbYI [1] SiMBA - https://github.com/DenuvoSoftwareSolutions/SiMBA https://github.com/DenuvoSoftwareSolutions/SiMBA [2] Gamba - https://github.com/DenuvoSoftwareSolutions/GAMBA https://github.com/DenuvoSoftwareSolutions/GAMBA [3] MSiMBA - https://github.com/mazeworks-security/MSiMBA https://github.com/mazeworks-security/MSiMBA

2c2c2c 1y ago

years ago, a friend of mine built something functionally equivalent to Denuvo in his spare time over the span of a few years. I think his original idea was "DRM for the little guy", recognizing that indie games probably lose massive revenue from initial release piracy. He had no idea how to sell it. After it sitting around for awhile, I tried pitching the technology to few friends in VC, who had absolutely no idea what I was talking about. It bothered me for a long time to see such a culmination of talent and effort get 0 reward for it. I've wondered if such technology would be interesting to some large publisher to just buy outright, bringing their anti-piracy in-house rather than relying on Denuvo. Any ideas/help appreciated :)

HighGoldstein 1y ago
> recognizing that indie games probably lose massive revenue from initial release piracy. This seems like an odd claim _especially_ for indie games. Indie games tend to already have trouble attracting buyers, it feels like anyone considering pirating it would just move on if they couldn't do so.
- 2c2c2c 1y ago
  Can't say I was sold with the target market mostly because the sales problem becomes orders of magnitude harder My thought regarding indie games were successful ones though. Something like Celeste or Balatro.
  - ronsor 1y ago
    I pay for games because it's convenient. Most DRM is decidedly inconvenient for me, especially Denuvo-tier DRM. The end result is that if there's DRM, I'm more likely to pirate it or not play it if there's no crack.
    - gruez 1y ago
      How's denuvo "inconvenient"? For the overwhelming majority of people, it just works and they don't even know it's there.

shmerl 1y ago

Vote with your wallet and don't buy games with this junk.

LightHugger 1y ago
Worth noting that denuvo causes a lot of hitching, massive load time increases and overall performance problems. Denuvo marketing dept likes to say this isn't true but you only have to look at the before/after on games with and without it, monster hunter world was a very stark example. I have no doubt denuvo is also massively contributing to the performance problems on Monster Hunter Wilds as well.
- shmerl 1y ago
  Of course. DRM can never improve user experience, it's an anti-user feature by definition.
  - Tadpole9181 1y ago
    Not going to take sides on the particular debate, but one could certainly argue that DRM is just a double-edge blade. The world is less fun with less art and games. And those require money to be made. The cost of securing that or making legitimate purchases cheaper (broadening the legal market) may be the initial online requirement and potential performance impacts. Again, I'm not saying Denuvo is or is not a net in one way or the other. Just that there is room for gray.
    - account42 1y ago
      There are plenty of commercial games that make the development costs back without any use of DRM. Also, art and games don't require money to be made. And I'd also argue that we don't actually need more games since we already have many - getting more is nice but we don't have to throw away our principles for it.
  - billmcneale 1y ago
    > it's an anti-user feature by definition. That's an extremely naive take that shows some stark ignorance of the tech and market forces at work. From a tech standpoint, Denuvo negatively impacting performance has been debunked many times over (see my previous post about that). On the economical side, you need to realize that whenever you are playing and enjoying a game, it's most likely due to the fact that the previous games sold by that developer have been successful in making money, which was most likely made possible by Denuvo. In other words, making piracy harder allows the next generation of games to be created.

larodi 1y ago

ph34r! op is top

hoseja 1y ago

Buy from GoG and indies Don't play AAA slop