Denuvo responds to popular hypervisor cracks

In recent weeks, Denuvo, the highly controversial anti-tampering DRM software that ships with some of the most popular games released on Steam, has taken some major hits, thanks to a new exploit used by pirates called “Hypervisor Bypass”.

While in the past pirates had to wait until the publisher stopped paying for Denuvo before they “cracked” a game, the Hypervisor approach has led to titles being bypassed by the day, including Crimson Desert and Resident Evil Requiem.

Need For Speed Unbound: An Aston Martin standing in a square

Family

The number of uncracked games with Denuvo is shrinking

Off that list are several sports or racing titles, such as Need for Speed Unbound.

Now Irdeto, the parent company of Denuvo, has confirmed that it is aware of the methods used and that it is actively working to combat them.

Countermeasures are coming, but it's unclear what they are

“We are already working on updated security versions for games affected by hypervisor bypass,” Daniel Butschek, Irdeto's director of communications, told TorrentFreak. “For players, performance will not be compromised by these enhanced security measures.”

What those countermeasures are remains to be seen. Butschek confirmed that they will not involve Denuvo moving into deeper core levels of Windows, as previously theorized by PC enthusiasts.

“Addressing hypervisor-based solutions will not require Denuvo to move to the Ring -1 or deeper core level, and that is not the direction we are pursuing,” said Butschek.

In addition to confirming that the company is aware of the ongoing bypasses, Butschek also reiterated an important caveat for the whole Hypervisor approach: security.

“Hypervisor-based bypasses rely on the installation of a custom, self-signed hypervisor that runs under the Windows kernel, giving it much broader control than a standard driver,” Butschek said. “To run, users must disable major Windows security protections such as Virtualization-Based Security (VBS), Hypervisor-Enforced Code Integrity (HVCI), and driver signature enforcement, which are designed to prevent kernel-level malware, rootkits, and ransomware”

Denuvo and Irdeto do their thing, but it's worth noting that the Hypervisor approach has undergone a serious security moderation. There is a whole regulatory community and strict rules that pirates follow before they go public. Pirates will also prompt that there are security issues with all downloads and not just Hypervisor specifically.

Given the current state of piracy, with the number of Denuvo-locked games dwindling by the day, it will be fascinating to see what Denuvo does to combat things and what pirates will do to keep the sauce rolling. That there is even an acknowledgment of countermeasures is a sign of how badly things have gone.