Denuvo fell.And risk taking over the gaming industry |

Two weeks ago, the Denuvo system, which has been protecting video games for years, was hacked.But the problem is serious: the method found by pirates leaves the computer unprotected and poses a great security risk.

A few weeks ago, a pirated version of one of Capcom's most anticipated titles, Resident Evil Requiem, became available for download just hours after its official launch.

For those familiar with the PC gaming market;This was immediately disappointing as the game was protected by five layers of DRM.Among them is Denuvo, the anti-piracy system loved by software houses and hated by users that the gaming industry has relied on for more than a decade.

Resident Evil Requiem was not an isolated incident: when a pirated version of Crimson Desert was published even a day after its release, it was understood that what had always been denied had been extinguished.

With the first major consequences for users, in terms of security, and the second for all activities that have already been affected by rising costs and reduced profits.

To understand why, however, we need to take a step back and start with Denuva, which is not a simple system that protects the game executable, it is a really sophisticated system.In fact, it uses license tokens generated server-side and tied to specific machine hardware, and can hide its operating logic inside customized virtual machines, making the code nearly unreadable to anyone trying to analyze it.Cracking a Denuvo-protected title wasn't impossible, but it required months of reverse engineering by highly specialized crackers.

It was a classic piracy of tolerance: for game developers, these months have to break the title in order to use the game commercially, sales are made in the first weeks, the commercial window.

Although Denuvo exploded, this celebration disappeared.

A crack that isn't even a crack

The risks of piracy have been talked about and reported on for the past few days, and this story fits perfectly, so much so that it was asked about in the comments of the article.The reason is simple.the way the games are loaded requires users to raise the computer's security to such a level that a pirate could be said to be trading in a 90 euro game at the risk of having much more stolen from him.

According to research, users of pirated services lose 1,200 euros per person due to fraud and data theft.

All systems today organize access facilities into numerical levels, called "rings".A series of concentric circles, the closer you are to the center, the more power you have on the systems.

Software runs in Ring 3, the outermost layer, with limited and controlled access.The Windows kernel, which is the heart of the operating system, runs in Ring 0: it can do almost everything, but it is still protected by the best protections.Denuvo works at this level to perform its own checks on the originality of the copy.

Until now, all hacking systems, “prepared” specifically for each individual game, try to work at the same level as the kernel, analyzing and neutralizing each Denuvo control.The work is so big that it takes months to track them all, and in many cases we are unable to do so.

Come hanno fatto quindi a craccare Denuvo? Sono scesi ancora più in basso ad un livello, il Ring -1, che è nato nel momento in cui è stata introdotta nelle CPU la virtualizzazione hardware. È un livello ancora più privilegiato perché è usato dagli hypervisor, i software che gestiscono macchine virtuali (come VMware o VirtualBox).

The complete reverse engineering of the hacking technique has been published for those interested

I pirati, installando un hypervisor personalizzato, riescono a spostare il sistema operativo Windows sopra di esso come se fosse un ospite e quindi l'hypervisor diventa il vero padrone della macchina, con accesso illimitato a tutto. Da questa posizione il crack intercetta ogni richiesta hardware di Denuvo come i controlli identificativi della CPU, le misurazioni, le variabili di sistema e restituisce valori falsificati, facendo credere al software di protezione che tutto sia regolare.

Per chi se lo stesse chiedendo è possibile eseguire Windows sopra un hypervisor senza reinstallarlo grazie a tecniche di virtualizzazione avanzata che permettono di “inserire” un livello di controllo sotto il sistema operativo già in esecuzione. Intel e AMD hanno driver specifici per farlo, e i pirati li hanno sfruttati. Windows viene così trasformato dinamicamente in una macchina virtuale, mentre l’hypervisor assume il controllo diretto dell’hardware, operando a un livello più privilegiato.

This means that the Denuvo code is never touched or modified, because there is nothing "cracked": the game runs in its original form.One could even say that he is in a kind of "Matrix", a simulated reality created specifically to deceive him.

This is why never-cracked versions of games have been appearing on pirate sites for weeks. A single method has effectively neutralized the most advanced software anti-piracy method that has ever existed.

A crack that risks seriously harming the pirate

Too bad all of this has a scary part: in order to run highly unsigned Windows checkers like Denuvo crack requires users to disable the entire Windows security architecture.Block-to-block protections include virtual-based security that separates critical credentials and processes in a separate, uncontrolled environment, the authenticity of the code used by the supervisor, which prevents unsigned code from being executed in the kernel and signature execution.Driver that ensures that all installed drivers are from a source approved by Microsoft.

Needless to say, this is a crazy situation: it means handing over the keys to your computer to a program written by someone who is a hacker for life (or as a hobby).

And it could do anything: read memory, hack credentials or install rootkits, all in a completely untraceable way.

Irdeto ha confermato di essere al lavoro su contromisure, ma molti utenti esperti sono scettici: gli anelli di protezioni sono fatti proprio per impedire a chi sta dentro un anello di vedere cosa succede “dietro”, e rilevare un hypervisor dal sistema operativo virtualizzato è praticamente impossibile. Sarebbe come cercare di capire dall’interno di una stanza finta se è davvero finta osservando le pareti.

To do this, Denuvo would have to go to the same level, outside the system, but as crazy as it is that pirated software has such a privilege, it is equally crazy to give it to Denuvo.It is also unlikely that Microsoft would allow a third party to have that level of control over its system.

Also, Denuo has been criticized several times for the computational load placed on the game, penalizing performance: the risk is that Denuo is even heavier, so those who buy games out of their own pocket will be penalized.

Un disastro per l'industria videoludica

Denuvo's downfall is a second problem.There are great risks that a person can face, especially when faced with the possibility of getting something for free, they do not carefully evaluate what this could cause.This time the risk is serious.But above all, it is a wake-up call for the industry which in recent years has faced many employment conflicts, the failure of historic libraries, the cancellation of projects and the collapse of public trust.

The economic model of AAA PC games rests on one pillar: the game's launch period must generate enough revenue to justify years of development.

Without monitoring, the release of zero-day pirated publications will become commonplace, eroding the growing base.As a result, those who like to play, respect the domain, buy games they can afford, and wait for those who might like to play but know how to wait, fall in price.

One of them could be the "always online" model, which makes the game useless without a constant connection to the servers.While mobile gaming is gaining traction thanks to solutions like Rogue Ally, the requirement of an active connection for license verification threatens to kill the entire segment in its infancy.

In the long term, this could also lead to an acceleration towards cloud gaming, which paradoxically would be the only streaming service today that is not hackable and secure.For publishers, this is the ultimate solution to the problem of piracy, but for gamers, it means not only losing complete ownership of games, but also ending the enjoyment of a gaming PC.

For those who like to play, the loss of the computer they have carefully built is difficult to calculate.