[Protection] Add Denuvo detection #56

New Issue

claunia · 2026-01-29T21:05:27Z

claunia commented

2026-01-29 21:05:27 +00:00

Originally created by @TheRogueArchivist on GitHub (Jan 18, 2022).

Originally assigned to: @mnadareski on GitHub.

New protection, needs more research.

http://redump.org/discs/quicksearch/Denuvo/protection/only

Originally created by @TheRogueArchivist on GitHub (Jan 18, 2022). Originally assigned to: @mnadareski on GitHub. New protection, needs more research. http://redump.org/discs/quicksearch/Denuvo/protection/only

claunia added the enhancement label 2026-01-29 21:05:27 +00:00

claunia closed this issue

2026-01-29 21:05:28 +00:00

claunia commented

2026-01-29 21:05:28 +00:00

@PurpleNekoNova commented on GitHub (Jan 18, 2022):

Common in newer Capcom games (Resident Evil 7, Marvel vs. Capcom: Infinite)

Some of these may have had physical releases [Check Europe]
https://www.game-debate.com/games/gamesWithDenuvo
https://store.steampowered.com/curator/26095454-Denuvo-Games/

@PurpleNekoNova commented on GitHub (Jan 18, 2022): Common in newer Capcom games (Resident Evil 7, Marvel vs. Capcom: Infinite) Some of these may have had physical releases [Check Europe] https://www.game-debate.com/games/gamesWithDenuvo https://store.steampowered.com/curator/26095454-Denuvo-Games/

claunia commented

2026-01-29 21:05:28 +00:00

@TheRogueArchivist commented on GitHub (Jun 17, 2022):

It seems that this is able to detect Denuvo, and based on a quick glance through the source, it should be an easy detection to add with samples. https://github.com/horsicq/Detect-It-Easy

@TheRogueArchivist commented on GitHub (Jun 17, 2022): It seems that this is able to detect Denuvo, and based on a quick glance through the source, it should be an easy detection to add with samples. https://github.com/horsicq/Detect-It-Easy

claunia commented

2026-01-29 21:05:28 +00:00

@Sewer56 commented on GitHub (Apr 1, 2024):

(Note that I'm still super tired, so apologies if I do a silly)

Anyway, I noticed most of the Denuvo code is commented, as there's TODOs in there.

An alternative version agnostic way of detecting Denuvo (that works for games at least as far back as 2016) is scanning for the null terminated string https://support.codefusion.technology (UTF16). This is the activation portal (support website) they use when the binary is unable to connect to their activation servers.

You then get 4 bytes (unknown purpose) and (in all my samples) 01 00 00 00 66 66 66 2E 0F 1F 84 00 00 00 00 00. Following that is another null terminated string which contains the specific product ID. For example, in Persona 5 Royal, this is P5R_9AG4H12

Combine the two, you get
https://support.codefusion.technology/P5R_9AG4H12

Of course, this is an extremely hacky approach, but a 3rd party program is very unlikely to have the same memory layout there, and the net it catches in terms of DRM versions is extremely wide.

Note: This does not apply to some EA games because they have a more custom solution and don't use this web portal.

@Sewer56 commented on GitHub (Apr 1, 2024): (Note that I'm still super tired, so apologies if I do a silly) Anyway, I noticed most of the Denuvo code is commented, as there's TODOs in there. ---------------- An alternative version agnostic way of detecting Denuvo (that works for games at least as far back as 2016) is scanning for the null terminated string `https://support.codefusion.technology` (UTF16). This is the activation portal (support website) they use when the binary is unable to connect to their activation servers. You then get 4 bytes (unknown purpose) and (in all my samples) `01 00 00 00 66 66 66 2E 0F 1F 84 00 00 00 00 00`. Following that is another null terminated string which contains the specific product ID. For example, in `Persona 5 Royal`, this is `P5R_9AG4H12` Combine the two, you get `https://support.codefusion.technology/P5R_9AG4H12` Of course, this is an extremely hacky approach, but a 3rd party program is very unlikely to have the same memory layout there, and the net it catches in terms of DRM versions is extremely wide. Note: This does not apply to some EA games because they have a more custom solution and don't use this web portal.

claunia referenced this issue

2026-01-29 21:07:28 +00:00

[PR #56] [MERGED] Add support for Microsoft SFX CAB detection #257

claunia referenced this issue

2026-01-29 21:07:29 +00:00

[PR #56] Add support for Microsoft SFX CAB detection #260

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SabreTools/BinaryObjectScanner#56