Denuvo

Denuvo Software Solutions GmbH is an Austrian company formed through the management buyout of Sony DADC DigitalWorks, the creators of SecuROM. Despite the management buyout, Denuvo Software Solutions and Sony DADC still have a close working relationship with the latter acting as a reselling partner of the former. Some games making use of the Denuvo Anti-Tamper product will therefor include mentions of this relationship in their EULAs, and refer to the product as one by Sony DADC or similar.

Official website

Denuvo article on Wikipedia

Denuvo Anti-Cheat

Despite being listed on the official website since at least January 2017, this product from Denuvo does not seem to have received much fanfare or use among video games publishers. In August 2018, Irdeto announced the Anti-Cheat technology would soon to be launches as a full end-to-end solution. With this renewed focus on the Anti-Cheat product it is to be expected at least some upcoming games will make use of the technology.

Denuvo Anti-Tamper

Denuvo Anti-Tamper is the current de-facto standard for securing DRM schemes on modern titles. Since its original release back in 2014, it have been used to strengthen the DRM of over 150 titles; some with great success, others less so. At its core, it uses various obfuscation techniques (such as unique hardware-based code paths and virtualization) to make tampering with the account-based DRM (e.g. Microsoft Store, Origin, Steam, or Uplay) protection of a game harder in an attempt to delay piracy. It is embedded in the executable of the game, and only stores licensing data (the "offline token" used to launch the game) separately on the disk. This licensing data is typically a couple of kilobytes in size, and is (re)created when the system environment changes enough to necessitate a new token.

A consequence of its use of unique hardware-based code paths, Denuvo Anti-Tamper requires an online connection periodically as the system environment of the operating system changes with new hardware and/or Windows updates. While everything that might invalidate the token stored on the drive is not fully known, this happens frequently enough for the anti-tamper protection to be described as requiring a periodic online connection every two week or so. This generally is not an issue or hindrance for those with an always present online connection, but can be for people primarily roaming or gaming offline if not proper preparations are made in advance to ensure the validity of the offline token. The lack of transparency regarding this process from Denuvo Anti-Tamper is a hindrance for affected users, as it means few might be aware of Denuvo's presence before being put in a position were the existence of it negatively harms the user experience.

Requires an online connection at the first launch of a game, after a game update or some Windows updates, when changing specific hardware, or the built-in expiration^{[citation needed]} (if used) has passed.

Limited to five daily activations per game, which resets 24 hours after the first activation.

Capable of offline token renewal through a support page (e.g. Metal Gear Solid V: The Phantom Pain) if supported by the game. Origin and Uplay titles do not support this as their token generation is handled within their respective internal activation process where offline is not an option.

Does not degrade storage drives lifetime, performance in itself, nor has ever enforced a persistent online connection.

Can increase the difficulty of binary modding, due to its obfuscation of certain parts of the executable. Doesn't necessarily disallow the practice, nor debugging.

Redeem.exe

Official redeem website

This is a DRM scheme employed on the retail discs in some regions, and is used to authenticate the physical disc as well as a one-time serial key to redeem a Steam key for a game.

Steam

Flowchart over launch procedure for Steam titles.

Based on data gathered from Steam-based Denuvo protected titles by monitoring operations performed by Denuvo protected titles through the use of Process Monitor, Fiddler, and in some instances also Wireshark, the basic overview in how the anti-tamper components interacts with the system is quite minimal:

1. At the launch of a game a validation of the offline token is performed.
2. If the offline token is invalid or missing, an appropriate request code is generated based on the system environment and sent to an online server.
3. The online server responds with a corresponding response code.
4. The local anti-tamper component uses the response code to write a new valid offline token to the local drive.
5. The game continues to launch along with the now valid offline token.
6. On subsequent launches the anti-tamper protection will automatically load and make use of the offline token stored on the disk, up until said token is made invalid again.

Beyond the mentioned online connection above, as well as the disk read, and disk write if the offline token is invalid, no other online connection nor disk reads/writes are performed during play.

For Steam protected titles, if the online connection fails the user will get an "offline activation" option where they can make use of a secondary online connected device to retrieve the corresponding response code, an option not available for either Origin, Uplay, or possibly other supported platforms' protected titles as well. The availability of this second option means a local token generator is more than possible for a fully offline procedure, as was confirmed in 2017 with the release of an unofficial offline token generator for Dishonored 2.

Technical information

All servers seems to be hosted on Amazon Web Services (AWS) datacenter EU West 1 in Ireland.

Support pages / "offline activation" pages / redeem.exe:

• support.codefusion.technology [52.16.106.153]

Used for Steam protected titles:

Currently load-balanced between two AWS instances using round-robin DNS.

• srv01.codefusion.technology
• srv02.codefusion.technology
• srv03.codefusion.technology

Unknown usage:

Test server? Generates valid offline tokens.

• srv00.codefusion.technology [52.50.151.143]

Also load-balanced between the two aforementioned AWS instances.

• srv04.codefusion.technology
• srv05.codefusion.technology

Request/Response API

• Content-Type: text/plain
• Method: POST
• Body: the generated request code (nothing else)
• https://52.50.151.143/ | https://srv00.codefusion.technology/ <--- Unknown usage. Test server?
• https://52.16.106.153/validate/ | https://support.codefusion.technology/validate/ <--- Used for "offline activation" for Steam protected titles.
• https://52.17.173.247/ | https://srv01... -> https://srv03... <--- Used for Steam protected titles.
• https://52.18.94.153/ | https://srv01... -> https://srv03... <--- Used for Steam protected titles.
• Expected body reply: proper request code taking up 5000+ characters, or a short reply (10~30 characters) which can be assumed to be an error code of sorts.

Warner Bros titles

Currently only known to be used for Mad Max and Batman Arkham Knight.

Domains:

• revalidate.wbgames.com - Load-balanced between two AWS instances using round-robin DNS
• Support pages:
  • https://revalidate.wbgames.com/madmax/
  • https://revalidate.wbgames.com/bak/

Servers: (Hosted on AWS, US East 1, Virginia)

Round-robin DNS load balanced:

• 35.169.86.124
• 34.200.59.160

Request/Response API

• Content-Type: text/plain
• POST
• Body: the generated request code (nothing else)
• https://35.169.86.124/ | https://34.200.59.160/ | https://revalidate.wbgames.com/
• https://35.169.86.124/validate/ | https://34.200.59.160/validate/ | https://revalidate.wbgames.com/validate/ <--- Used for "offline activation" for Steam protected titles.
• Expected body reply: proper request code taking up 5000+ characters. a short reply (10~30 characters) can be assumed to be an error code of sorts.

Work in progress

Topics that might or might not be covered:

• How does Denuvo interact with operating system? What does it rely upon? What options does the user have?
  • Differences between Origin, Uplay, and Steam protected titles
  • WB Games' own server revalidate.wbgames.com
  • srv01-03.codefusion.technology / support.codefusion.technology
  • Offline token files stored on the disk
    • for Steam: game-specific under Steam\userdata\[userid]\[gameid]).
    • Needs to be rechecked:
      • for Uplay: under Uplay\cache\activations in a single account-specific file that stores all tokens for that account;
      • for Origin: game-specific files under C:\ProgramData\Electronic Arts\EA Services\License;
• "Offline" activation proceedure
• Concerns
  • Online reliance due to design
  • Leftover files post-uninstall (aka the offline token files)
  • Performance impact
  • SSD read/writes
  • Compatibility
    • SSE4.1 instruction set
    • Linux Wine/Steam Proton