Had also a look at Denuvo a while ago. Used LLVM to remove the x86 obfuscation and broke it down to VM-Opcodes. Atleast back then, Denuvo seemd to translate gamecode into a stackmachine.
This is how a VM push looks like:
temp[0]=add(mem[e268], fffffffffffffff8)
mem[temp[0]]]=mem[e560]
mem[e268]=temp[0]
(vmreg_e268 is stackpointer, its decremented and stored in tempreg, then the value of vmreg_e560 is copied to stackpointeraddr, then new stackpointervalue is written back)
But i quickly lost interest when it became MBA galore:
temp[7]=sub(add(add(and(mem[ebe8], b2f7), 3fd8), xor(lshr(mem[ebe8], 1), 2684)), lshr(add(mem[ebe8], b2f8), 1))
temp[d]=or(sub(sub(4ad, temp[7]), xor(and(shl(temp[7], 1), 95c), 95c)), 8000)
temp[e]=lshr(temp[d], 1)
temp[11]=lshr(add(temp[d], 8001), 1)
mem[ebe8]=sub(xor(xor(temp[e], 3fff), temp[11]), shl(and(and(temp[e], 3fff), temp[11]), 1))
(looks like its doing some operation with a constant to vmreg_ebe8, but obfuscated by MBAs and most likely the result won't ever being used, so its just noise to drown out the real operations)
BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ?
This is how a VM push looks like:
(vmreg_e268 is stackpointer, its decremented and stored in tempreg, then the value of vmreg_e560 is copied to stackpointeraddr, then new stackpointervalue is written back)But i quickly lost interest when it became MBA galore:
(looks like its doing some operation with a constant to vmreg_ebe8, but obfuscated by MBAs and most likely the result won't ever being used, so its just noise to drown out the real operations)BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ?