---
type: analysis
title: FitDNuvo — Standalone Chain Mapping
description: Map of the F1 25 standalone initialization chain
tags: [fitdnuvo, denuvo, standalone, chain, reverse-engineering]
timestamp: 2026-06-29
---

# FitDNuvo — Standalone Initialization Chain Mapping

**Date:** 2026-06-29
**Status:** In progress — SPEAR/loopback protocol analysis phase
**Goal:** Complete F1 25 standalone (no Steam, no EA servers, with GPU and functional save)

---

## Current State

### What WORKS
- ✅ **Goldberg Steam Emulator** — steam_api64.dll replaced, SteamAPI_Init returns true
- ✅ **Preloader V4** — Original DllMain (UD2 traps intact), preloader_link_func → ret 1
- ✅ **TLS Callbacks** — CB0, CB1, CB2 execute normally
- ✅ **Process starts** — 423MB RAM, 9 threads, 80 modules
- ✅ **TCP Server** — port 47584 starts and accepts connections

### What DOESN'T work
- ❌ **GPU never initializes** — D3D12CreateDevice is never called (0% GPU)
- ❌ **SPEAR stub** — EAAntiCheat.GameServiceLauncher.exe replaced with stub that just exits
- ❌ **Loopback handshake** — engine ↔ Denuvo VM on port 47584 is ESTABLISHED but stuck

### Current blocker
```
F1_25.exe (423MB, 9 threads)
  ├── Server TCP 0.0.0.0:47584 (LISTENING)
  ├── Client TCP 172.25.128.1:47584 ↔ 172.25.128.1:60704 (ESTABLISHED, stuck)
  └── Engine waiting for response from Denuvo VM on loopback
```

## Chain Map

```
Windows Loader
  │
  ├── TLS Callback CB0 (0x8f1b5f0, .tls XRW) → Denuvo VM bootstrap
  │     └── Allocates VM memory, starts TCP server :47584
  │
  ├── TLS Callback CB1 (0x18e20, .sbss XR) → Engine init
  │     ├── CALL 0x18d30 (.sbss)
  │     └── CALL 0x5370860 (.sbss)
  │
  ├── TLS Callback CB2 (0x1355af90, .tls XRW) → License validation
  │     ├── LoadLibrary("preloader_l.dll")
  │     │     └── DllMain → UD2 → SEH handler → init SPEAR + VM context
  │     ├── GetProcAddress("preloader_link_func")
  │     │     └── RET (eax = status) ← our V4 patch: mov eax,1
  │     └── LaunchProcess("EAAntiCheat.GameServiceLauncher.exe")
  │           └── SPEAR stub → exit(0) ← BLOCKER: no handshake
  │
  ├── main() / WinMain
  │     ├── SteamAPI_Init() → Goldberg → true ✓
  │     ├── ... engine init ...
  │     ├── D3D12CreateDevice() ← NEVER REACHES HERE
  │     └── Render loop
  │
  └── [BLOCKER] Engine thread waits for response from Denuvo VM on port 47584
```

## Chain Components

| Component | Size | Status | Action |
|-----------|---------|--------|------|
| F1_25.exe | 399MB | Original | Patch: TLS callbacks (optional?) |
| preloader_l.dll | 46KB | V4 | Patch: preloader_link_func=1 ✓ |
| steam_api64.dll | 299KB | Goldberg | Replaced ✓ |
| EAAntiCheat.GameServiceLauncher.exe | 17MB | Stub 515B | Needs stub with handshake |
| EAAntiCheat.GameServiceLauncher.dll | 48MB | Original | Analyzing protocol |
| EAAntiCheat.cfg | ~14KB | Original | Analyzing configuration |
| steam_appid.txt | - | 3059520 | Created ✓ |

## Next Steps

1. **Port 47584 protocol** — discover handshake format
   - Ghidra analysis of SPEAR DLL (agent running)
   - Active port probing (agent running)
2. **Spec-compliant SPEAR stub** — implement correct handshake
3. **GPU test** — verify D3D12CreateDevice after handshake
4. **Save test** — verify local saving
5. **Final cleanup** — remove unnecessary components

## See Also

- [[fitdnuvo-denuvo-analysis]] — Complete Denuvo architecture analysis
- [[fitdnuvo-scanner]] — Automated PE Scanner