Hacker News Reader

Comment by fsloth | Hacker News Reader

Getting a dubious stream is far less risky than running a dubious binary. But maybe people would not care supporting bot networks and other maladies.

View on HN

In general dubious binaries aren't really a problem, because releases tend to be done by people or groups with reputations. Lots of people are ideologically or technologically motivated to release stuff and have been doing so for many years.

And now a days in the age of Denuvo and things like this, cracked binaries are sometimes even 'cleaner' than the official releases.

Unlikely most of the Denuvo cracks actually remove the virtualized code from the executable. Not feasible without extensive binary rewriter tooling (that, while being sloppable, still takes a lot of time to slop).

Interesting yeah you're right. Looking it up it seems that only 2 of the Denuvo cracks have completely removed Denuvo - oddly enough Assassin's Creed games both times. Usually they just use various tricks to fool the authentication, but leave the performance degradation and other issues of Denuvo.

It'll be interesting to see if LLMs do increase the rate of completely cleans.

Devirtualization and recompilation is unfortunately a really, really tough task even for clank assisted RE.

I can't edit this post anymore but if you wanna read a bunch of stuff on the topic https://k0mkc.hatenablog.com/ is a nice blog. All in Japanese, but it should be perfectly translatable.

Funny thing is they removed all their blogposts on Griffin (an obfuscator several anticheats, including EA's, Riot's and FaceIT's utilize) for whatever reason.

Reply on news.ycombinator.com