// Detect It Easy: detection rule file
// Author: deadmau5 <deadmau5@tutanota.de>
// Updated: DosX (@DosX-dev)
// Updated 2: Nitr0-G (@Nitr0-G) (16.05.2025)
// Updated 3: 0x80000003 (@0x80000003) (20.09.2025)
// Updated 4: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Denuvo
meta("protector", "Denuvo");

function detect() {
    if (PE.isNet()) return; // Native code only

    if (PE.isSectionNamePresentExp(/\.(e|sr|x(p|d))data$/) || PE.isSectionNamePresent(".arch") || PE.isSectionNamePresent(".xtext") || PE.isSectionNamePresent(".xtls")) {
        if (PE.is64()) {
            // Mad Max, Metal Gear Solid: TPP, Rise of the Tomb Raider
            if (PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")) {
                sVersion = "1.0";
                bDetected = true;
            }
            // Lords of the Fallen, Batman: AK, Just Cause 3, Sherlock Holmes: TdD, Tales of Berseria etc
            else if (PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")) {
                sVersion = "2.0a";
                bDetected = true;
            }
            // Yesterday Origins
            else if (PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")) {
                sVersion = "2.0b";
                bDetected = true;
            }
            // Sniper Ghost Warrior 3 (beta), Dead Rising 4 (SteamStub-free)
            else if (PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")) {
                sVersion = "3.0a";
                bDetected = true;
            }
            // Atomic Heart
            else if (PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")) {
                sVersion = "17.0"; // v17.0, what? How?
                bDetected = true;
            }
            // Train Sim World CSX Heavy Haul
            else if (PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")) {
                sVersion = "3.0b";
                bDetected = true;
            }
            // Hello Kitty : Island Adventure / Unity
            else if (PE.compareEP("47 61 6D 65 41 73 73 65 6D 62 6C 79 44 65 6E 75 76 6F 44 72 6D 2E 64 6C 6C")) {
                sOptions = "Unity"; // The actual game exe won't show up as Denuvo because it only loads the GameAssembly.dll which is the one protected by Denuvo
                bDetected = true;
            } else if (PE.isSignaturePresent(PE.section[0].FileOffset, PE.getSize() - PE.getOverlaySize(), "64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00")) {
                bDetected = true;
            }

            // Check if steam_api64.dll present
            if (PE.isLibraryPresent("steam_api64.dll")) {
                sOptions = "Steam";
                bDetected = true;
            }
            // Check if eossdk-win32-shipping.dll present
            if (PE.isLibraryPresent("eossdk-win64-shipping.dll")) {
                sOptions = "Epic Games";
                bDetected = true;
            }

        } else {
            // Pro Evolution Soccer 2017, Champions of Anteria
            if (PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")) {
                sVersion = "1.0";
                bDetected = true;
            }
            // Romance of 13 Kingdoms, 2Dark
            else if (PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")) {
                sVersion = "2.0";
                bDetected = true;
            }

            // Check if steam_api.dll present
            if (PE.isLibraryPresent("steam_api.dll")) {
                sOptions = "Steam";
                bDetected = true;
            }

            // Check if eossdk-win64-shipping.dll present
            if (PE.isLibraryPresent("eossdk-win32-shipping.dll")) {
                sOptions = "Epic Game Store";
                bDetected = true;
            }

            // Check if uplay_r1_loader.dll present
            if (PE.isLibraryPresent("uplay_r1_loader.dll")) {
                sOptions = "uPlay";
                bDetected = true;
            }

        }
    }

    if (!bDetected) {
        if (PE.isLibraryPresent("dbdata.dll")) {
            // Override additional info
            sOptions = "FIFA23 series";
            bDetected = true;
        }

        // Check if uplay_r1_loader64.dll present
        if (PE.isLibraryPresent("uplay_r1_loader64.dll")) {
            sOptions = "uPlay";
            bDetected = true;
        }

        // Check if Core/Activation64.dll present
        if (PE.isLibraryPresentExp(/^Core\/Activation(64)?.dll$/)) {
            sOptions = "Origin";
            bDetected = true;
        }

        if (PE.isExportFunctionPresent("GetDenuvoTicketLocation")) {
            bDetected = true;
        }

        if (PE.isExportFunctionPresent("GetDenuvoTimeTicketRequest")) {
            bDetected = true;
        }

    }

    if (PE.isExportFunctionPresentExp(/^ANTICHEAT_OBFUSCATE_.+_CODEMARKER$/)) {
        _setResult("marker", "Denuvo", String(), String());
    }

    return result();
}