<\/div>The term “Digital Rights Management” is such a deviously constructed bit of PR. It sounds like a good thing. “Digital Rights”. Those are good, right? But calling anti-copying software “Digital Rights Management” is like calling prison “Freedom Management”. It’s technically true, while also being a pretty good example of real-world doublespeak<\/a>. <\/p>\n In the case of videogames, DRM is any system intended to “manage” (limit) what you can do (your rights) with the software through various software tricks. The argument usually goes something like this:<\/p>\n <\/p>\n Company: User: Company: User: Company: User: Company: User: Company: User: Company: The argument reached this stalemate roughly a decade ago, and it’s been stuck there ever since. It wasn’t until Denuvo showed up that the landscape began to change.<\/p>\n Denuvo is DRM. No wait, according to other people it’s not DRM, but instead it’s a wrapper for DRM to protect it from tampering. No wait, according to the Wikipedia page<\/a> it’s both:<\/p>\n Denuvo Anti-Tamper, or Denuvo, is an anti-tamper technology and digital rights management (DRM) scheme developed by the Austrian company Denuvo Software Solutions GmbH, a company formed through the management buyout (MBO) of Sony DADC DigitalWorks.<\/p><\/blockquote>\n Whatever. For the purposes of this discussion, it’s DRM.<\/p>\n That’s an excellent question. This Reddit thread<\/a> begins with someone who claims they’ve studied Denuvo. They say it is specifically NOT “shrink wrap DRM”. (More on that in a minute.) Instead they describe it as a system where certain non-performantParts of the code that don’t need to go fast.<\/span> parts of the code are removed from the executable. When you activate the game, you are given the missing bits of code. However, these are specifically engineered to only work on your particular make, model, and revision of CPU. There are thousands of CPUs out there, which means that if you uploaded your build of the game to the torrents, only people with the exact same CPU thumbprint could run it. <\/p>\n But then the top reply to that post is another person, claiming this is all nonsense. They also have studied Denuvo and they insist it works differently. They claim that, “It uses a modified version of VMProtect 3 to virtualize many game functions, and a custom library that’s different from VMProtect’s for anti-debug, initial game decryptions as well as to implement some SDK features that lets the game check if it has been unpacked (known as “triggers” in older protections). Before running game code, it will call a DRM library which is specific to the underlying platform, such as Steam or Origin and others.”<\/p>\n That’s two different people making opposing, yet highly technical and very specific claims about how Denuvo works. <\/p>\n The Chinese pirate group 3DM has also worked on Denuvo. (And even cracked a version of it in 2014.) They claimed that the technology involves a “64-bit encryption machine” that requires cryptographic keys unique to the specific hardware of each installed system. That sounds like “shrink wrap DRM”, which contradicts both of the previous claims.<\/p>\n I obviously have no idea. The most likely cause of this confusion is that Denuvo takes many forms. It’s evolved rapidly over the years, and perhaps each of these people have encountered different versions of it. It’s also possible that Denuvo has many different “products” they license to developers at different price points, and each DRM product is a little different. <\/p>\n “Shrink Wrap” isn’t a specific DRM technique. Instead it’s a style of protecting software from tampering. It means you make standalone software, and before you deploy it you feed the executable (and maybe some other assets) into the DRM-O-Tron and it will spit out a version of the program that (in theory) is difficult to modify. The point being that your developers can wrap their program inside of the anti-tamper system without needing to add the DRM crap to their source code or complicate development. <\/p>\n I’ve mentioned before that I used to work at Activeworlds<\/a>. Back in 1998 or so, we had a problem with people hacking the client. Since a lot of the netcode had been designed in the naive, pre-dystopian internet of 1994, we had the unfortunate problem that the server always trusted the client. When someone sent a chat message, the client would send the text of the message, along with the user’s name. The server made no effort to make sure that the person supposedly sending the chat message was the same as the person’s account name. So you could hack your client to change how your name was displayed to other users. This means Bob could log in with his hacked client and begin typing chat messages that would appear (to other users) to be coming from Alan. <\/p>\n Now, this didn’t mean Bob had stolen Alan’s identity. Bob didn’t have Alan’s rights or powers. If Alan was an admin then his chat messages would appear in bold. If Bob impersonated him, Bob’s fake messages would not be bold. Still, this was a source of trouble for some time. Someone would drop into a densely populated area and begin putting words in other people’s mouths. A few racist slurs and threats was all it would take to turn a polite discussion into complete chaos and a bunch of complaints against people who hadn’t done anything wrong.<\/p>\n This is just one of many problems with the server trusting the client. Some of them could be fixed by making changes to the server, but some of them couldn’t. Eventually we decided to try to stop the troublemakers by using shrink-wrap anti-tamper software. I forget the name of the product we usedI wasn’t on the full time coding staff yet, so I didn’t use it directly. I was still on the art team and authoring tools.<\/span>, so let’s say it was called WidgetProtect. WidgetProtect promised that our software would be 100% tamper-proof, or our money back.<\/p>\n The hackers cracked it in two days.<\/p>\n We did not get our money back.<\/p>\n Their developers worked with ours for a few iterations, trying to tighten things up, but it was a lost cause. I’m pretty sure WidgetProtect just scrambled the executable on the disk, and then un-encrypted it into memory when the program was run. That’s hilariously primitive by today’s standards, but at the time it was good enough that the WidgetProtect guys thought they were unbeatable.<\/p>\n Once again, it depends on who you ask. In January 2016, cracking group 3DM warned that by 2018 games would be un-crackable. In the decades-long arms race between crackers and DRM, the DRM was finally pulling ahead. While it’s still true that unbeatable DRM is impossible<\/a>, it is possible to make DRM so tedious and time-consuming to break that it’s no longer worth the effort. It took two and a half months to crack DOOM<\/a> last year, which is enough to protect a game for the majority of its sales and relevance. <\/p>\n On the other hand: A few days after DOOM was cracked, Inside<\/em> and Rise of the Tomb Raider<\/em> were cracked using the same technique. So maybe the arms race is on again?<\/p>\n Obviously to answer this question you’d have to study the problem. But as the conflicting reports demonstrate, even supposed experts can have wildly different opinions on how things work and what is and isn’t possible.<\/p>\n While I haven’t been able to answer anyone’s pressing questions about Denuvo and how it works, I think the whole thing has been very illuminating for gaming culture as a whole. <\/p>\n For a long time publishers hit us with dire claims about how 90% or even 99% of game copies were pirated. We were told that piracy was destroying the industry and causing a huge loss of income. Many of us were skeptical about this rhetoric, but it wasn’t the sort of thing you could disprove. <\/p>\n But now we’ve had several AAA games arrive on the scene and remain safe from piracy for months, and it’s pretty clear that the dire claims were just as ridiculous as we suspected. Game profits have not shot up. Rise of the Tomb Raider didn’t attain 10× the typical PC sales, despite the fact that for 8 long months it was unavailable to those pirates that made up 90% of the player base. If Denuvo caused a visible spike in PC sales then they surely would have begun crowing about it by now.<\/p>\n Piracy is no longer a handy scapegoat for publishers. They blamed piracy for studio closures, low profits, and high prices. But Denuvo put a serious dent in piracy without any of those things changing. (And why would they? The public has already demonstrated they’re willing to buy games for $60 + DLC, so the only reason to lower prices is to be nice.) <\/p>\n The one good thing about Denuvo is that it seems to be painless for us non-pirates. I’ve apparently played a number of Denuvo games without even knowing it. I didn’t have Denuvo lock me out of a game because I plugged in a USB audio device, or make me type in some stupid activation key, or make me log in to some nonsense server. I’ve said before that convenience is king, and Denuvo is at least built so as to not make a product more inconvenient to use.<\/p>\n Then again: What happens in the future? If Denuvo is based on CPU thumbprint or some other nonsense, then what happens on the new processors of the future? Will the game fail to install? Fail to activate? Fail to run? Impossible to say.<\/p>\n","protected":false},"excerpt":{"rendered":" For over a year people have been requesting that I weigh in on Denuvo, the fancy new DRM that has all the publishers excited. What is it? How does it work? How effective is it? DRM used to be a major part of my writing. I still care about the issue, but I eventually stopped […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[102],"tags":[],"class_list":["post-38251","post","type-post","status-publish","format-standard","hentry","category-weekly-column"],"_links":{"self":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts\/38251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=38251"}],"version-history":[{"count":0,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts\/38251\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=38251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=38251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=38251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThis DRM system makes sure that you can’t pirate the game. <\/p>\n
\nBut now I can’t make backups of my software! And it’s really inconvenient!<\/p>\n
\nSorry, but we need this system to stop pirates.<\/p>\n
\nBut (vague reference to court case) guarantees that I have the right to make backups for personal use!<\/p>\n
\nActually you gave up that right when you broke the seal on the package \/ clicked “I Agree” on the EULA.<\/p>\n
\nBy that logic, any consumer right could be negated at any time by any company, simply by making waiving that right a requirement for using the product.<\/p>\n
\nThese measures are helping us fight piracy.<\/p>\n
\nBut it doesn’t stop pirates! Games are always available to the pirates, sometimes even before launch!<\/p>\n
\nBy the way, even if you DON’T accept the EULA, you can’t return the product. <\/p>\n
\nThis is bullshit!<\/p>\n
\nThanks for being a valued customer! <\/p><\/div>\nHow Does it Work?<\/h3>\n
<\/div>Shrink Wrap DRM<\/h3>\n
<\/div>So How Good is Denuvo?<\/h3>\n
<\/div>What Have We Learned?<\/h3>\n
<\/div>