初级玩家
- 贡献度
- 0
- 金元
- 425
- 积分
- 43
- 精华
- 0
- 注册时间
- 2019-8-31
|
Not sure if you've noticed or not.. but just in case.. open ACValhalla.exe in a debugger. Go to first executable code section. Is the code visible (no spaghetti)? I can tell you that the executable code is perfectly visible and there's no code unpacking occurring at startup. Even so.. I've created a proxy DLL for Batman: Arkham Knight which uses MinHook to break on a certain location I know represents the end of the Denuvo unpacking process. And it's not checked for integrity. Once hit, I would then patch whatever I needed 
Anyway, proxy d3d9.dll in a minute (with source code). It's funny.. Ubisoft uses it to simply query graphics adapter features and for the Ubisoft Connect overlay (they hook Direct3DCreate9).
You would just drop it in the game folder and that's that. DLL will scan for an array of bytes in the process it's automatically loaded into (either ACValhalla.exe or ACValhalla_plus.exe), then patch what the CE script does  0x84 to 0x32 at scan-found location. Easy peasy.
I'd actually recommend not saying "Denuvo+VMProtect" just cuz you've seen it flaunted around. Denuvo relies on VMProtect functionality for its VM virtualization/mutation. When you see crax0rs saying "+VMProtect" it's because VMProtect SDK features are used: like the packer that's unpacking the code based on whether or not the license is valid and the code integrity checks passed. Bet you never thought that "+" has a meaning
The DLL is inside \x64\Release folder. Copy or extract it from there directly to your main game folder, like so:
Image
Launch the game like nothing happened  Enjoy!
P.S.1: If the signature is not found, you will get a message box saying just that, but game will continue to load (nothing gets patched). Keep this in mind for future DLCs/updates, when Ubi might pull yet another stunt.
P.S.2: To coders/devs out there - I really don't give a crap how my code looks like. Wanna optimize it, make it smaller, more compact, go ahead The aim here was functionality, not looks or actuality.
Last edited by SunBeam on Saturday, 20 Feb 2021, 09:08, edited 1 time in total.Not sure if you've noticed or not.. but just in case.. open ACValhalla.exe in a debugger. Go to first executable code section. Is the code visible (no spaghetti)? I can tell you that the executable code is perfectly visible and there's no code unpacking occurring at startup. Even so.. I've created a proxy DLL for Batman: Arkham Knight which uses MinHook to break on a certain location I know represents the end of the Denuvo unpacking process. And it's not checked for integrity. Once hit, I would then patch whatever I needed
Anyway, proxy d3d9.dll in a minute (with source code). It's funny.. Ubisoft uses it to simply query graphics adapter features and for the Ubisoft Connect overlay (they hook Direct3DCreate9).
You would just drop it in the game folder and that's that. DLL will scan for an array of bytes in the process it's automatically loaded into (either ACValhalla.exe or ACValhalla_plus.exe), then patch what the CE script does 0x84 to 0x32 at scan-found location. Easy peasy.
I'd actually recommend not saying "Denuvo+VMProtect" just cuz you've seen it flaunted around. Denuvo relies on VMProtect functionality for its VM virtualization/mutation. When you see crax0rs saying "+VMProtect" it's because VMProtect SDK features are used: like the packer that's unpacking the code based on whether or not the license is valid and the code integrity checks passed. Bet you never thought that "+" has a meaning
The DLL is inside \x64\Release folder. Copy or extract it from there directly to your main game folder, like so:
Image
Launch the game like nothing happened Enjoy!
P.S.1: If the signature is not found, you will get a message box saying just that, but game will continue to load (nothing gets patched). Keep this in mind for future DLCs/updates, when Ubi might pull yet another stunt.
P.S.2: To coders/devs out there - I really don't give a crap how my code looks like. Wanna optimize it, make it smaller, more compact, go ahead The aim here was functionality, not looks or actuality.
Last edited by SunBeam on Saturday, 20 Feb 2021, 09:08, edited 1 time in total.Not sure if you've noticed or not.. but just in case.. open ACValhalla.exe in a debugger. Go to first executable code section. Is the code visible (no spaghetti)? I can tell you that the executable code is perfectly visible and there's no code unpacking occurring at startup. Even so.. I've created a proxy DLL for Batman: Arkham Knight which uses MinHook to break on a certain location I know represents the end of the Denuvo unpacking process. And it's not checked for integrity. Once hit, I would then patch whatever I needed
Anyway, proxy d3d9.dll in a minute (with source code). It's funny.. Ubisoft uses it to simply query graphics adapter features and for the Ubisoft Connect overlay (they hook Direct3DCreate9).
You would just drop it in the game folder and that's that. DLL will scan for an array of bytes in the process it's automatically loaded into (either ACValhalla.exe or ACValhalla_plus.exe), then patch what the CE script does 0x84 to 0x32 at scan-found location. Easy peasy.
I'd actually recommend not saying "Denuvo+VMProtect" just cuz you've seen it flaunted around. Denuvo relies on VMProtect functionality for its VM virtualization/mutation. When you see crax0rs saying "+VMProtect" it's because VMProtect SDK features are used: like the packer that's unpacking the code based on whether or not the license is valid and the code integrity checks passed. Bet you never thought that "+" has a meaning
The DLL is inside \x64\Release folder. Copy or extract it from there directly to your main game folder, like so:
Image
Launch the game like nothing happened Enjoy!
P.S.1: If the signature is not found, you will get a message box saying just that, but game will continue to load (nothing gets patched). Keep this in mind for future DLCs/updates, when Ubi might pull yet another stunt.
P.S.2: To coders/devs out there - I really don't give a crap how my code looks like. Wanna optimize it, make it smaller, more compact, go ahead The aim here was functionality, not looks or actuality.
Last edited by SunBeam on Saturday, 20 Feb 2021, 09:08, edited 1 time in total.
|
|
[复制链接]
发表于 2024-4-20 12:53
