Hi guys,
I heared about DENUVO that uses a CPU bound code to make it harder to crack, some code that run only on your CPU. So i was looking for some nice trick and testings tring to emulate that.
I started using CPUD changing values in EAX, my curiosity was on:
 

MOV EAX, 0Bh
CPUID

This give me some values, including in EDX wich core is executing that CPUID. (core1 - core2 etc)

BUT
i found this "feature" , if you do:
 

MOV ECX, 100h
MOV EAX, 0Bh
CPUID

You reset all your registers and you get only a value in EDX, where is showed your current core...
Is that normal??
I have a i7-2600, can someone with different CPU try if have same results?

The Denuvo thing is probably utter horseshit (especially if you read this on reddit).

Anyways, you can find the documentation of the CPUID here: http://x86.renejeschke.de/html/file_module_x86_id_45.html

On my PC, it clears EAX, EBX, ECX, EDX (which are registers that CPUID puts results in according to the documentation). It doesn't clear any other registers:

Greetings

Thanks for your time

Someone in CPY might know much more about your target.

 

Oh, sounds pretty interesting http://denuvo.com/#page-5

Edited March 17, 20169 yr by arlequim
added link

CPY didn't unpack denuvo, they hooked some stuff to bypass license and integrity protections

Wow, they did even better. Thanks for info Mr.eXoDia   Although i dont know at all this protector, i think they chose the most intelligent tactic and cracking approach, i mean no unpack and secured result

uses a fair bit more than just cpuid information like hdd info (boot drive serial number, and videocard data enum) to name a few

On 3/19/2016 at 8:48 AM, evlncrn8 said:

uses a fair bit more than just cpuid information like hdd info (boot drive serial number, and videocard data enum) to name a few

Anyone confirmed what info is actually used in denuvo(VMProtect) ?

well for the ea stuff, its the same thing in denuvo - hdd serial, video card enum, computer name etc, all built up into a hash.. for the steam stuff, steam user id etc along with he usual cpuid stuff securom used..