// Detect It Easy: detection rule file
// Author: deadmau5 <deadmau5@tutanota.de>
// Updated: DosX (@DosX-dev)
// Updated 2: Nitr0-G (@Nitr0-G) (16.05.2025)
// Updated 3: 0x80000003 (@0x80000003) (20.09.2025)
// Updated 4: BJNFNE <bjnfne@web.de>

// https://en.wikipedia.org/wiki/Denuvo
meta("protection", "Denuvo");

function detect() {
    if (PE.isNet()) return; // Native code only

    if (PE.getNumberOfSections() > 10 &&
        PE.isSectionNamePresentExp(/^\.[ex](text|code)$/) &&
        PE.isSectionNamePresentExp(/^\.([eu]|my|s[xr]|x[pd])data$/) || PE.isSectionNamePresent(".arch") || PE.isSectionNamePresent(".xtls")) {
        if (PE.is64()) {
            /*
            - Mad Max
            - Metal Gear Solid
            - TPP
            - Rise of the Tomb Raider
            */
            if (PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")) {
                sVersion = "1.0";
                bDetected = true;
            }
            /*
            - Lord of the Fallen
            - Batman
            - AK
            - Just Cause 3
            - Sherlock Holmes
            - TdD
            - Tales of Bersia
            */
            else if (PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")) {
                sVersion = "2.0a";
                bDetected = true;
            }
            // Yesterday Origins
            else if (PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")) {
                sVersion = "2.0b";
                bDetected = true;
            }
            // Sniper Ghost Warrior 3 (beta), Dead Rising 4 (SteamStub-free)
            else if (PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")) {
                sVersion = "3.0a";
                bDetected = true;
            }
            /*
            - Atomic Heart
            - Deathloop
            - Immortals Fenyx Rising
            - Evil Genius
            - Yakuza Like A Dragon
            */
            else if (PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")) {
                sVersion = "12.0-17.0+";
                bDetected = true;
            }
            // Train Sim World CSX Heavy Haul
            else if (PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")) {
                sVersion = "3.0b";
                bDetected = true;
            }
            // Hello Kitty : Island Adventure / Unity
            else if (PE.compareEP("47 61 6D 65 41 73 73 65 6D 62 6C 79 44 65 6E 75 76 6F 44 72 6D 2E 64 6C 6C")) {
                sOptions = "Unity"; // The actual game exe won't show up as Denuvo because it only loads the GameAssembly.dll which is the one protected by Denuvo
                bDetected = true;
                /*
                - Doom The Dark Ages
                - Dragon Quest XI
                - Resident Evil 4
                - South Park
                - Tekken 7
                - Trials of Mana
                - Total War: Warhammer 2
                */
            } else if (PE.isSignaturePresent(PE.section[0].FileOffset, PE.getSize() - PE.getOverlaySize(), "64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00")) {
                bDetected = true;
            }

            // Check if steam_api64.dll present
            if (PE.isLibraryPresent("steam_api64.dll")) {
                sOptions = "Steam";
                bDetected = true;
            }

            // Check if eossdk-win32-shipping.dll present
            if (PE.isLibraryPresent("eossdk-win64-shipping.dll")) {
                sOptions = "Epic Games";
                bDetected = true;
            }

        } else {
            // Pro Evolution Soccer 2017, Champions of Anteria
            if (PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")) {
                sVersion = "1.0";
                bDetected = true;
            }
            // Romance of 13 Kingdoms, 2Dark
            else if (PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")) {
                sVersion = "2.0";
                bDetected = true;
            }

            // Check if steam_api.dll present
            /*
            - Thrones of Britannia
            */
            if (PE.isLibraryPresent("steam_api.dll")) {
                sOptions = "Steam";
                bDetected = true;
            }

            // Check if eossdk-win64-shipping.dll present
            if (PE.isLibraryPresent("eossdk-win32-shipping.dll")) {
                sOptions = "Epic Game Store";
                bDetected = true;
            }

            // Check if uplay_r1_loader.dll present
            if (PE.isLibraryPresent("uplay_r1_loader.dll")) {
                sOptions = "uPlay";
                bDetected = true;
            }

        }
    }

    if (!bDetected) {
        if (PE.isLibraryPresent("dbdata.dll")) {
            // Override additional info
            sOptions = "FIFA23 series";
            bDetected = true;
        }

        // Check if uplay_r1_loader64.dll present
        if (PE.isLibraryPresent("uplay_r1_loader64.dll")) {
            sOptions = "uPlay";
            bDetected = true;
        }

        // Check if Core/Activation64.dll present
        if (PE.isLibraryPresentExp(/^Core[\\/]Activation(64)?\.dll$/i)) {
            sOptions = "Origin";
            bDetected = true;
        }

        if (PE.getNumberOfImports() > 10 && PE.isLibraryPresentExp(/^d3d/i) && PE.isExportFunctionPresentExp(/^GetDenuvo(TimeTicketRequest|TicketLocation)$/)) {
            bDetected = true;
        }
    }

    if (PE.isExportFunctionPresentExp(/^ANTICHEAT_OBFUSCATE_(?:.+_)?CODEMARKER$/)) {
        _setResult("marker", "Denuvo", String(), String());
    }

    return result();
}