高级玩家
- 贡献度
- 4
- 金元
- 2795
- 积分
- 296
- 精华
- 0
- 注册时间
- 2010-10-20
|
Not sure if you've noticed or not.. but just in case.. open ACValhalla.exe in a debugger. Go to first executable code section. Is the code visible (no spaghetti)? I can tell you that the executable code is perfectly visible and there's no code unpacking occurring at startup. Even so.. I've created a proxy DLL for Batman: Arkham Knight which uses MinHook to break on a certain location I know represents the end of the Denuvo unpacking process. And it's not checked for integrity. Once hit, I would then patch whatever I needed
Anyway, proxy d3d9.dll in a minute (with source code). It's funny.. Ubisoft uses it to simply query graphics adapter features and for the Ubisoft Connect overlay (they hook Direct3DCreate9).
You would just drop it in the game folder and that's that. DLL will scan for an array of bytes in the process it's automatically loaded into (either ACValhalla.exe or ACValhalla_plus.exe), then patch what the CE script does 0x84 to 0x32 at scan-found location. Easy peasy.
I'd actually recommend not saying "Denuvo+VMProtect" just cuz you've seen it flaunted around. Denuvo relies on VMProtect functionality for its VM virtualization/mutation. When you see crax0rs saying "+VMProtect" it's because VMProtect SDK features are used: like the packer that's unpacking the code based on whether or not the license is valid and the code integrity checks passed. Bet you never thought that "+" has a meaning
The DLL is inside \x64\Release folder. Copy or extract it from there directly to your main game folder, like so: |
|
[复制链接]
发表于 2021-2-25 20:44
