DiE 3.11 vs. Most recent Denuvo

[4IbWNsis3S]

I just wanted to see if DiE 3.11 could detect more than entropy, compression, and section names with a recent Denuvo binary. This is a very very recent Denuvo binary that likely bought the custom option.. The one identifying section-string changed.

Detection:

(Heur) Protection: Generic [Strange sections + Section #12 (".text1") has RWX]
(Heur) Packer: Generic [Last section EP + Strange jmp at EP + Section #1 (".00cfg") compressed]
(Heur) Debug data: Contains [Section #0 (".debug") + Portable PDB (release)]
Overlay: Binary (Store) [Offset = 0x1f671400, Size = 0x3dd8]
Certificate: WinAuth (2.0) [PKCS #7]

Memory Map:

Offset Address Size Name
0000000000000000 0000000140000000 0000000000000600 Header
0000000140000600 0000000000000a00 Header (virtual)
0000000000000600 0000000140001000 000000000898f000 Section (1) [".debug"]
000000000898f600 0000000148990000 000000000247e000 Section (2) [".00cfg"]
000000000ae0d600 000000014ae0e000 0000000000487000 Section (3) [".xpdata"]
000000000b294600 000000014b295000 0000000000000200 Section (4) [".rodata"]
000000014b295200 00000000004d8e00 Section (4) [".rodata"] (virtual)
000000000b294800 000000014b76e000 0000000000001000 Section (5) [".debug$P"]
000000000b295800 000000014b76f000 0000000000001000 Section (6) [".data2"]
000000000b296800 000000014b770000 0000000000001000 Section (7) [".code"]
000000000b297800 000000014b771000 0000000000002000 Section (8) [".sdata"]
000000000b299800 000000014b773000 0000000000002000 Section (9) [".arch"]
000000000b29b800 000000014b775000 0000000000003000 Section (10) [".shared"]
000000000b29e800 000000014b778000 000000000004e000 Section (11) [".data1"]
000000000b2ec800 000000014b7c6000 000000000031d000 Section (12) [".rsrc"]
000000000b609800 000000014bae3000 000000000b743a00 Section (13) [".text1"]
0000000157226a00 0000000000000600 Section (13) [".text1"] (virtual)
0000000016d4d200 0000000157227000 0000000000000200 Section (14) [".udata"]
0000000157227200 0000000000000e00 Section (14) [".udata"] (virtual)
0000000016d4d400 0000000157228000 0000000000003c00 Section (15) [".sbss"]
000000015722bc00 0000000000000400 Section (15) [".sbss"] (virtual)
0000000016d51000 000000015722c000 0000000000000200 Section (16) [".bss"]
000000015722c200 0000000000000e00 Section (16) [".bss"] (virtual)
0000000016d51200 000000015722d000 00000000004d9000 Section (17) [".idata"]
000000001722a200 0000000157706000 0000000000001000 Section (18) [".3k"]
000000001722b200 0000000157707000 0000000000000600 Section (19) [".rdata"]
0000000157707600 0000000000000a00 Section (19) [".rdata"] (virtual)
000000001722b800 0000000157708000 0000000008445c00 Section (20) [".pdata"]
000000015fb4dc00 0000000000000400 Section (20) [".pdata"] (virtual)
000000001f671400 0000000000003dd8 Overlay

Optional Header:

Name Offset Type Value
Magic 0000 WORD 020b NT_OPTIONAL_HDR64_MAGIC
MajorLinkerVersion 0002 BYTE 0e
MinorLinkerVersion 0003 BYTE 00
SizeOfCode 0004 DWORD 17229800 370.16 MiB
SizeOfInitializedData 0008 DWORD 004d8c00 4.85 MiB
SizeOfUninitializedData 000c DWORD 00000000 0 Bytes
AddressOfEntryPoint 0010 DWORD 17708000 Section (20) [".pdata"]
BaseOfCode 0014 DWORD 00001000 Section (1) [".debug"]
0000
ImageBase 0018 ULONGLONG 0000000140000000
SectionAlignment 0020 DWORD 00001000 4.00 KiB
FileAlignment 0024 DWORD 00000200 512 Bytes
MajorOperatingSystemVersion 0028 WORD 0006 Windows Vista
MinorOperatingSystemVersion 002a WORD 0000
MajorImageVersion 002c WORD 0000
MinorImageVersion 002e WORD 0000
MajorSubsystemVersion 0030 WORD 0006
MinorSubsystemVersion 0032 WORD 0000
Win32VersionValue 0034 DWORD 00000000
SizeOfImage 0038 DWORD 1fb4e000 507.30 MiB
SizeOfHeaders 003c DWORD 00000600 1.50 KiB
CheckSum 0040 DWORD 1f678a1b
Subsystem 0044 WORD 0002 WINDOWS_GUI
DllCharacteristics 0046 WORD 8120 HIGH_ENTROPY_VA | NX_COMPAT | TERMINAL_SERVER_AWARE
SizeOfStackReserve 0048 ULONGLONG 0000000000c71b00 12.44 MiB
SizeOfStackCommit 0050 ULONGLONG 0000000000101000 1.00 MiB
SizeOfHeapReserve 0058 ULONGLONG 0000000000100000 1.00 MiB
SizeOfHeapCommit 0060 ULONGLONG 0000000000001000 4.00 KiB
LoaderFlags 0068 DWORD 00000000
NumberOfRvaAndSizes 006c DWORD 00000010

Section Entropy:

Offset Size Entropy Status Name
0000000000000000 0000000000000600 2.93889 not packed Header
0000000000000600 000000000898f000 6.64204 packed Section (1) [".debug"]
000000000898f600 000000000247e000 7.81212 packed Section (2) [".00cfg"]
000000000ae0d600 0000000000487000 7.74478 packed Section (3) [".xpdata"]
000000000b294600 0000000000000200 7.30901 packed Section (4) [".rodata"]
000000000b294800 0000000000001000 7.69420 packed Section (5) [".debug$P"]
000000000b295800 0000000000001000 7.69010 packed Section (6) [".data2"]
000000000b296800 0000000000001000 7.69479 packed Section (7) [".code"]
000000000b297800 0000000000002000 7.69234 packed Section (8) [".sdata"]
000000000b299800 0000000000002000 7.92716 packed Section (9) [".arch"]
000000000b29b800 0000000000003000 7.90349 packed Section (10) [".shared"]
000000000b29e800 000000000004e000 7.96768 packed Section (11) [".data1"]
000000000b2ec800 000000000031d000 7.82637 packed Section (12) [".rsrc"]
000000000b609800 000000000b743a00 6.71753 packed Section (13) [".text1"]
0000000016d4d200 0000000000000200 4.98332 not packed Section (14) [".udata"]
0000000016d4d400 0000000000003c00 3.45967 not packed Section (15) [".sbss"]
0000000016d51000 0000000000000200 7.43671 packed Section (16) [".bss"]
0000000016d51200 00000000004d9000 7.32734 packed Section (17) [".idata"]
000000001722a200 0000000000001000 0.16369 not packed Section (18) [".3k"]
000000001722b200 0000000000000600 3.07916 not packed Section (19) [".rdata"]
000000001722b800 0000000008445c00 7.32494 packed Section (20) [".pdata"]
000000001f671400 0000000000003dd8 7.54173 packed Overlay

EP(17708000 .pdata):

0D  EA  BC  7B  02  49  81  C1  E8  44  00  00  50  49  8B  C1 
48  05  7D  74  AE  FD  49  91  58  41  50  41  50  48  8D  64 
24  F8  C7  04  24  00  00  00  00  C7  44  24  04  00  00  00 
00  41  58  4C  33  44  24  10  4C  89  44  24  08  41  58  49 
F7  D9  48  C7  44  24  08  13  DD  E9  20  48  81  74  24  08 
13  DD  E9  20  4C  29  4C  24  08  53  BB  4D  54  CE  2C  48 
81  F3  48  F5  0C  2B  0F  82  05  00  00  00  E9  A1  75  2A 
00  0F  86  9B  75  2A  00  5F  48  C7  C7  98  7E  8B  C6  48

Base of Code(00001000 .debug):

56  57  48  83  EC  28  48  89  CE  45  31  C0  85  D2  75  2B 
44  3B  46  0C  74  1D  44  89  46  0C  8B  56  08  C7  44  24 
20  08  00  00  00  41  B9  98  00  00  00  48  89  F1  E8  7D 
71  0D  03  90  48  83  C4  28  5F  5E  C3  89  D7  48  63  C2 
48  69  C8  98  00  00  00  BA  08  00  00  00  E8  7F  01  84 
03  48  B9  5F  43  79  0D  E5  35  94  D7  48  F7  E1  48  C1

[hypn0chka]

Please share a sample. You can check Denuvo (v.5 - v.19) presenсe by searching "denuvo_atd" string in binary. But it works only for Denuvo v5.0 and higher. Versions prior to 5.0 did not contain text strings to identify them.
Complete detection of all of Denuvo versions is almost nearby (I'm just a lazy ass :). But your sample will be very useful for clarification.
The existing Denuvo detection script is very weak, detecting only the presence of Denuvo and only versions higher than 5.0. It's not worth drawing any serious conclusions from this, although it does detect versions higher than 5.0 well, but without specifying the version number.

[4IbWNsis3S]

pastebin com /J65M0AkK

The only "denuvo" in the whole file is "mov rcx, 4F56554E45444F44h" in .text1 which is a VM encryption handler that uses it somehow to unwrap handlers with some xor loop and junk code.

It's definitely newer the binary is from a 8/25 major release. I have a 3/25 Denuvo binary too. I'll get a newer binary when a big release comes that likely bought all the features. Small studio Denuvo releases are missing a lot of Denuvo features.

Side-Note: Ring 0 emulation will be detected in coming version

[BJNFNE]

pastebin com /J65M0AkK

The Link wont work

[BJNFNE]

@4IbWNsis3S Could you check if your Denuvo executable has exported functions called GetDenuvoTicketLocation and GetDenuvoTimeTicketRequest?

[BJNFNE]

@4IbWNsis3S please update the DiE database: da714da