Denuvo

Denuvo

300px
Website
https://denuvo.com/
Parent company
Irdeto
Founded
2013

Denuvo Software Solutions GmbH is an Austrian company formed through the management buyout of Sony DADC DigitalWorks, the creators of SecuROM. Despite the management buyout, Denuvo Software Solutions and Sony DADC still have a close working relationship with the latter acting as a reselling partner of the former. Some games making use of the Denuvo Anti-Tamper product will therefor include mentions of this relationship in their EULAs, and refer to the product as one by Sony DADC or similar. In early 2018, Denuvo Software Solutions was acquired by Irdeto.

Denuvo Anti-Cheat

Despite being listed on the official website since at least January 2017, this product from Denuvo does not seem to have received much fanfare or use among video games publishers. In August 2018, Irdeto announced the Anti-Cheat technology would soon launch as a full end-to-end solution. The following year, on 20 March 2019, a launch announcement was made about the new product. According to the announcement, Denuvo Anti-Cheat combines machine learning of game agnostic process metrics with the latest hardware security features offered by Intel and AMD to detect and prevent cheating. The protection supposedly operates on the binary, not the source code, and integrates directly into the product build process, and also does not interfere with debuggers, instrumentation tools, or profilers, nor does it require additional APIs or SDKs to implement. Since it uses hardware-backed security, the protection goes beyond that which is offered by simple Windows kernel-mode drivers.

With this renewed focus on the Anti-Cheat product, it is expected that at least some upcoming games will make use of the technology.

Denuvo Anti-Tamper

Flowchart over launch procedure for Steam titles.

Denuvo Anti-Tamper is the current de-facto standard for securing DRM schemes on modern titles. Since its original release back in 2014, it has been used to strengthen the DRM of over 150 titles; some with great success, others less so. At its core, it uses various obfuscation techniques, such as unique hardware-based code paths, virtualization, and more, to make tampering with the account-based DRM protection of a game (e.g. Microsoft Store, Origin, Steam, or Uplay) harder in an attempt to delay piracy. It is embedded in the executable of the game, and only stores licensing data (the "offline token" used to launch the game) separately on the storage drive. This licensing data is typically a couple of kilobytes in size, and is (re)created when the system environment changes enough to necessitate a new token.

A consequence of its use of unique hardware-based code paths, Denuvo Anti-Tamper requires an online connection periodically as the system environment of the operating system changes with new hardware and/or Windows updates. While everything that might invalidate the token stored on the storage drive is not fully known, this happens frequently enough for the anti-tamper protection to be described as requiring a periodic online connection every fortnight or so. This is generally not an issue or hindrance for those with an always present online connection, but can be an annoyance for people primarily using roaming data. Players gaming offline for a long period of time can also suffer if proper preparations are not made in advance to ensure the validity of the offline token. The lack of transparency on storefronts regarding this process from Denuvo Anti-Tamper is a hindrance for potential purchasers, as it means people might not be aware of Denuvo's presence before purchasing a game that, after purchase, the purchaser may have a game that harms their experience.

Limited to five daily activations per game, which resets 24 hours after the first activation.

Capable of offline token renewal through a support page (e.g. Metal Gear Solid V: The Phantom Pain) if supported by the platform. Origin and Uplay titles do not support this as their token generation is handled within the platforms respective internal activation process where offline is not an option.

Does not degrade storage drives lifetime, performance in itself, nor has it ever enforced a persistent online connection.

Can increase the difficulty of executable binary modding, due to its obfuscation of certain parts of the executable. Doesn't necessarily disallow the practice, nor debugging.

Controversy

Due to Denuvo Anti-Tamper having seen year-long successes early in its product life there was and have been quite a lot of fear, uncertainty, and doubt spread around it as a product. On top of this, the lack of proper in-depth analysis of its effect from third-parties has also contributed to the speculations and misleading reports spread around online.

Requires an online connection at the first launch of a game, after a game update or some Windows updates, when changing specific hardware, or the built-in expiration^{[citation needed]} (if used) has passed.

Because of how Denuvo Anti-Tamper works, and its functions are unknown to the average consumer, users tend to be quick to blame it for issues that's most likely caused by something else entirely.

This section strives to be more focused on specific controversies surrounding Denuvo Anti-Tamper. For general DRM controversies, please see the main DRM article.

Examples of controversies:

• It can have a noticeable impact on gameplay performance.
  • This is generally found to be wrong, although with some remarks. As with everything else in the world of programming, each "line of code" technically has a "cost" in the form of the CPU having to spend CPU cycles to perform the operation (how many CPU cycles it takes depends on how heavy the operation is). So what matters when discussing gameplay performance is how noticeable a supposed performance impact is, and whether it is perceivable during regular play. The protection does not rely or make use of the GPU at all, and so what matters is how it affects the CPU time of a game, which typically is not what most games bottleneck on.
  • In a few rare instances more heavy anti-tamper protection checks have been a part of performance critical functions and thereby had a more noticeable impact on gameplay performance. An example of this is with Tekken 7, where functions related to certain characters' abilities was used by the anti-tamper protection and impacted gameplay performance when used.
    • In some instances (Sonic Mania, Injustice 2) the more noticeable slowdowns caused by anti-tamper bypasses active in illegitimate copies of games was blamed on the anti-tamper protection as well, despite not having a noticeable, or less of a noticeable, impact on legitimate copies.
    • Typically fixed in game updates, as developers notices the performance-impacting bug and solves it by flagging the relevant functions as performance critical to prevent the use of them by the anti-tamper.
  • The CPU impact of the protection differs between games, but is generally regarded as unnoticeable during regular play.
    • When benchmarking and comparing an unprotected executable with a protected executable in the graphics-heavy Final Fantasy XV, the developer Peter "Durante" Thoman of PH3 Games discovered no performance impact to the gameplay between the executables, although loading times were found to be different (which matches up with Denuvo's statements of where the protection is the most active).
    • Digital Foundry at Eurogamer performed a similar benchmark of the release version of Devil May Cry 5 and found that while the unprotected copy performed ~7% faster in extreme CPU-bound scenarios, the difference of 13 FPS (173 FPS vs. 186 FPS) at the high frame rates raised the question whether users would even notice the difference. They continued with mentioning how modern gaming PCs should have the CPU overhead to run the extra load incurred by what their tests suggests to be Denuvo Anti-Tamper, but noted that it is none the less concerning to see a ~7% impact on a CPU as capable as the Intel Core i5 8400 (which runs six cores at a peak of 3.8 GHz). Comparably, benchmarks performed by other outlets reported slightly lower impacts of around 3-4%.

• Requires a persistent online connection / adds an always online requirement to games.
  • This has been found false multiple times, as the protection only has an one-time online requirement when the offline token is found invalid, see the general description above as well as the Steam section further down for further information.
  • In the case of Sonic Mania's "always online requirement" on release date, it was discovered to be caused by a bug due to the developers' incorrect use of the Steam API, and could be fixed without ever tampering with the anti-tamper protection of the game.

• Causes excessive HDD/SSD reads/writes which degrades the lifespan of storage drives.
  • The origins of this rumor are various user reports from 2014 and "tests" performed using Lords of the Fallen and Dragon Age: Inquisition. This has been denied and debunked multiple times by both Denuvo themselves, publishers/developers, and other users since then. As shown in the Steam section further down, Denuvo performs minimal read and write operations to the drive, and there is no benefit to do additional drive reads or writes in terms of security or performance.

• Relies on the SSE4.1 CPU instruction set, causing incompatibility with AMD Phenom 2 and earlier CPUs.
  • This is another rumor that is blamed on Denuvo Anti-Tamper whenever a new game is released that makes use of SSE4.1 instructions for a function. To this day Denuvo Anti-Tamper itself has never showcased any reliance on the SSE4.1 instruction set, and developers often track down and fix the issue in the game code, without removing Denuvo Anti-Tamper.
  • Ubisoft is currently the only developer known to completely disregard support for older CPUs lacking SSE4.1 support on their more modern titles.

• Forced incompatibility with Linux through Wine/Steam Proton, or prevents native Linux ports from being developed and released.
  • Because earlier versions of Denuvo Anti-Tamper and/or Wine were incompatible with one another, the incompatibility was blamed as a conscious act on the anti-tamper protection. Said incompatibility seems to have been fixed, and Steam Proton officially supported two Denuvo Anti-Tamper protected titles on its initial release date (Tekken 7 and NieR: Automata), with other games, such as Hitman 2 also working on Proton, despite initially having Denuvo Anti-tamper at launch. Note that modern versions of Wine might still not fully support older versions of Denuvo Anti-tamper used on older titles.
  • The use of Denuvo Anti-Tamper has never prevented official Linux ports from being developed and released either, as evidenced by Hitman and Rise of the Tomb Raider which have both gotten native Linux and/or macOS ports before the protection was removed from the Windows version.

Epic Games Launcher

Uses the same general procedure and servers as Steam-based titles, based on testing performed on Metro Exodus.

The offline token is stored in %LocalAppData%\EpicGamesLauncher\ in a file with just a bunch of numbers as the filename and without a file extension.

Steam

A flowchart of the procedure can be found further up the page.

Based on data gathered from Steam-based Denuvo protected titles by monitoring operations performed by Denuvo protected titles through the use of Process Monitor, Fiddler, and in some instances also Wireshark, the basic overview in how the anti-tamper components interacts with the system is quite minimal:

1. At the launch of a game a validation of the offline token is performed.
2. If the offline token is invalid or missing, an appropriate request code is generated based on the system environment and sent to an online server.
3. The online server responds with a corresponding response code.
4. The local anti-tamper component uses the response code to write a new valid offline token to the local storage drive.
5. The game continues to launch along with the now valid offline token.
6. On subsequent launches the anti-tamper protection will automatically load and make use of the offline token stored on the storage drive, up until said token is made invalid again.

If the online connection fails the user will get a manual "offline" activation option where they can make use of a secondary online connected device to retrieve the corresponding response code, an option not available for either Origin, Uplay, or possibly other supported platforms either. The availability of this second option means a local token generator is theoretically possible for a fully offline procedure, as was confirmed in 2017 with the release of an unofficial offline token generator for Dishonored 2.

Beyond the mentioned online connection above, as well as the drive read, and drive write if the offline token is invalid, no other online connection nor drive reads/writes are performed during play.

The offline token is stored in Steam\userdata\<user-id>\<app-id>\ in a file with just a bunch of numbers as the filename and without a file extension. Note that the filename differs between versions of the game, so it is normal to have more than one of these files lying around. Only the latest modified file is actively being used; the older ones are inert and can be safely removed.

Technical information

All servers seems to be hosted on Amazon Web Services (AWS) datacenter EU West 1, Ireland.

Domain	Description
support.codefusion.technology	Responsible for the support pages and manual activation pages for both the anti-tamper protection as well as Redeem.exe for Steam-based games.
srv01.codefusion.technology srv02.codefusion.technology srv03.codefusion.technology	These domains are the primary ones used to retrieve a valid token in Steam-based games. If srv01 does not respond with a proper response code, srv02 is used instead. If srv02 also fails, srv03 is used instead. If all three fails, the user receives instructions on how to perform a manual "offline" activation using the relevant support.codefusion.technology page. Advanced: Load-balanced between two AWS instances using round-robin DNS.
srv00.codefusion.technology	Unknown usage. Possibly a test server of sorts as it is capable of generating valid response codes for Steam-based games.
srv04.codefusion.technology srv05.codefusion.technology	These two domains are also registered, but their use is currently unknown to this article. Advanced: Points to the same two aforementioned AWS instances.

Request/Response API

Advanced: The web API expects Content-Type: text/plain to be used in the request message.

The online component relies solely on standardized HTTPS communications and a simple web API, and fully respects and makes use of system-wide proxy configuration and internet settings. Basically the client (the game executable) sends the locally generated request code in the body of a HTTP request message to the online server using the POST method, and receives the appropriate response code back in the body of the response message. This single exchange (one sent request, one received response) is all that is needed for the anti-tamper component of the game executable to generate the appropriate offline token for the system.

Target URI	Description
https://srv01.codefusion.technology/ https://srv02.codefusion.technology/ https://srv03.codefusion.technology/	Used for the automatic activation process for Steam-based titles.
https://support.codefusion.technology/validate/	Used for the manual activation process for Steam-based titles.
https://srv00.codefusion.technology/	Unknown usage. Possibly a test server of sorts as it is capable of generating valid response codes for Steam-based games.

Warner Bros. titles

Currently only known to be used for Mad Max and Batman Arkham Knight.

All servers seems to be hosted on Amazon Web Services (AWS) datacenter US East 1, Virginia.

Domain / Website	Description
revalidate.wbgames.com	Only domain used by the protection in the Steam-based copies of Mad Max and Batman Arkham Knight. Advanced: Load-balanced between two AWS instances using round-robin DNS.
https://revalidate.wbgames.com/madmax/	Support page for Mad Max.
https://revalidate.wbgames.com/bak/	Support page for Batman Arkham Knight.
https://support.codefusion.technology/madmax/	Secondary support page for Mad Max, hosted on the generic Steam-based server.
https://support.codefusion.technology/bak/	Secondary support page for Batman Arkham Knight, hosted on the generic Steam-based server.

Request/Response API

Behaves the same as defined in the Technical information section above, just with different target URIs.

The generic Steam-based servers listed above can be used to generate valid offline tokens if Warner Bros. custom server would ever go down.

Target URI	Description
https://revalidate.wbgames.com/	Used for the automatic activation process of these two titles.
https://revalidate.wbgames.com/validate/	Used for the manual activation process of these two titles.

Redeem.exe

Official support page

Adds a requirement of having an optical disc drive available when purchasing physical copies of games to obtain the Steam key.

Also known as GIP or GIP Client.

This is a DRM scheme employed on the retail discs of some games (e.g. Deus Ex: Mankind Divided, NieR: Automata) in some regions and is used to authenticate the physical disc as well as a one-time serial key located on a leaflet in the disc case. After the authentication of both, a Steam activation key for the game is redeemed from an online database and granted to the user in the application window, which can then be used in the Steam client to unlock a copy of the game.

Issues fixed

Currently your game purchase cannot be re-validated successfully

Full error message: Currently your game purchase cannot be re-validated successfully, please wait 24 hours and try again.

Wait 24 hours before trying to launch the game again

This error message is given when the daily limit of five activations is reached for the user for the particular game, at which point no new activations will be granted until 24 hours has passed. If this issue persists the system might be in a state of flux and require constant renewals of the offline token of Denuvo Anti-Tamper. Ensure that the system have been restarted recently and verify that the operating system and drivers are up-to-date, and no installations or updates are pending.

Cannot start Redeem.exe on retail discs

Please see the game-specific articles for available workarounds for various issues affecting Redeem.exe, such as for Deus Ex: Mankind Divided.

If no workaround is available, the official support page can be used instead to make a manual redemption.

List of games using Denuvo Anti-Tamper

This list is auto-populated. To add a game, update the game-specific article with {{DRM|Denuvo Anti-Tamper}} where appropriate, e.g. in the Notes field of the availability row for the Steam release.

Total number of games: {{#ask: Uses DRM::Denuvo Anti-Tamper |format=count }}

{{#ask: Uses DRM::Denuvo Anti-Tamper

|?Part of series=Series
|?Developed by
|?Published by
|?Release date|+limit=1
|?Available on
|format=table
|limit=500
|template=Feature/row
|introtemplate=Feature/intro
|outrotemplate=Feature/outro
|sep=, 
|mainlabel=Game

}}

List of games formerly using Denuvo Anti-Tamper

This list is auto-populated. To add a game, update the game-specific article and replace {{DRM|Denuvo Anti-Tamper}} with {{Removed DRM|Denuvo Anti-Tamper}} where appropriate. Do not use on availability rows where Denuvo has never been present (e.g. on GOG.com releases).

Total number of games: {{#ask: Removed DRM::Denuvo Anti-Tamper |format=count }}

{{#ask: Removed DRM::Denuvo Anti-Tamper

|?Part of series=Series
|?Developed by
|?Published by
|?Release date|+limit=1
|?Available on
|format=table
|limit=500
|template=Feature/row
|introtemplate=Feature/intro
|outrotemplate=Feature/outro
|sep=, 
|mainlabel=Game

}}