---
type: tool
title: FitDNuvo Scanner v1.0
description: Automated PE Scanner with 62-signature fingerprint
tags: [fitdnuvo, scanner, pe, python, security]
timestamp: 2026-06-28
---

# FitDNuvo Scanner v1.0

**Script:** `/tmp/fitdnuvo_scanner.py`
**Runtime:** `uv run` (PEP 723, dependency: `pefile`)
**Date:** 2026-06-28

---

## Functionality

Automated scanner that detects Denuvo protection in Windows PE binaries. Operates in two layers:

1. **Import Fingerprint:** 62 imported function signatures organized in 9 categories (Core VM, Anti-Debug, License Validation, File I/O, Registry, System Info, Process Introspection, Crypto, Red Flags)

2. **Structural Heuristics:** Anomalies in PE structure that indicate Denuvo presence (giant TLS sections, high entropy, XRW sections, non-standard names)

---

## Uso

```bash
uv run /tmp/fitdnuvo_scanner.py <target.exe> [--json]
```

### Examples

```bash
# Full analysis with formatted output
uv run /tmp/fitdnuvo_scanner.py /tmp/fitdnuvo_F1_25.exe

# JSON output for automated processing
uv run /tmp/fitdnuvo_scanner.py /tmp/fitdnuvo_F1_25.exe --json

# Denuvo preloader analysis
uv run /tmp/fitdnuvo_scanner.py /tmp/fitdnuvo_preloader_l.dll
```

### Output

- **stdout:** Formatted report with progress bars per category
- **JSON:** `/tmp/fitdnuvo_report_<filename>.json` with complete structure

---

## JSON Report Structure

```json
{
  "file": "/tmp/fitdnuvo_F1_25.exe",
  "size": 399280512,
  "image_base": "0x140000000",
  "entry_point": "0x189ed020",
  "denuvo_score_pct": 14.5,
  "verdict": "DENUVO CONFIRMED (393MB VM payload)",
  "sections": [
    {
      "name": ".tls",
      "virtual_address": "0x6f9b000",
      "virtual_size": 296024419,
      "entropy": 6.85,
      "flags": "XRW"
    }
  ],
  "denuvo_regions": [
    {
      "section": ".tls",
      "confidence": 0.98,
      "reason": "[282.3MB] MASSIVE TLS section with XRW flags — Denuvo VM payload"
    }
  ],
  "engine_regions": [...],
  "fingerprint_matches": ["Anti-Debug", "Registry"],
  "import_summary": {
    "kernel32.dll": 302,
    "user32.dll": 94,
    "steam_api64.dll": 11,
    "sl.interposer.dll": 15
  },
  "summary": "============================================================\n..."
}
```

---

## Fingerprint Categories

| Category | Signatures | Weight |
|-----------|------------|------|
| Core VM | NtAllocateVirtualMemory, NtCreateSection, NtMapViewOfSection, NtProtectVirtualMemory, RtlAllocateHeap | High |
| Anti-Debug | ZwQueryInformationProcess, GetProcessWindowStation, SetWindowLongPtrW, ... | High |
| License Validation | ZwCreateUserProcess, ZwCreateThreadEx, ... | Medium |
| File I/O | ZwCreateFile, ZwDeleteFile, NtOpenFile, ... | Medium |
| Registry | RegGetValueW, RegOpenKeyExW, ... | Low |
| System Info | ZwQuerySystemInformation, RtlQueryEnvironmentVariable, ... | Low |
| Process Introspection | LdrGetProcedureAddress, LdrFindEntryForAddress, ... | High |
| Crypto/Integrity | MD5Init, MD5Update, ... | Medium |
| Red Flags | Pie (GDI32), MessageBoxW, RtlAppendUnicodeToString, ... | High |

---

## Structural Heuristics

| Heuristic | Confidence | Description |
|-----------|-----------|-----------|
| H1: Massive TLS | 98% | .tls section > 10MB with XRW = Denuvo VM payload |
| H2: High entropy | 90% | Entropy > 7.5 = packed/encrypted code |
| H3: XRW | 85% | Executable AND writable section = self-modifying JIT VM |
| H4: Suspicious name | 60% | Non-standard names (.sbss, .00cfg, .srdata, etc.) |
| H5: Executable BSS | 75% | Section with "bss" in name marked as executable |
| H6: Bootstrap stub | 70% | Tiny executable section after massive sections |

---

## Known Results

### preloader_l.dll
- **Score:** 71.0%
- **Verdict:** DENUVO DETECTED
- **Core VM:** 5/5 (100%)
- **Process Introspection:** 9/9 (100%)
- **Anti-Debug:** 8/9 (89%)
- **Red Flags:** 5/5 (100%)

### F1_25.exe
- **Score:** 14.5% (import) + structural confirmation
- **Verdict:** DENUVO CONFIRMED (393MB VM payload)
- **Denuvo Regions:** 9 (393MB)
- **Engine Regions:** 8
- **Largest hit:** .tls (282MB, 98%)

---

## See Also

- [[fitdnuvo-denuvo-analysis]] — Complete Denuvo architecture analysis
- chicotv — PC Windows com F1 25