FitDNuvo Scanner v1.0

Script: /tmp/fitdnuvo_scanner.py Runtime: uv run (PEP 723, dependency: pefile) Date: 2026-06-28

---

Functionality

Automated scanner that detects Denuvo protection in Windows PE binaries. Operates in two layers:

1. Import Fingerprint: 62 imported function signatures organized in 9 categories (Core VM, Anti-Debug, License Validation, File I/O, Registry, System Info, Process Introspection, Crypto, Red Flags)

2. Structural Heuristics: Anomalies in PE structure that indicate Denuvo presence (giant TLS sections, high entropy, XRW sections, non-standard names)

---

Uso

uv run /tmp/fitdnuvo_scanner.py <target.exe> [--json]

Examples

# Full analysis with formatted output
uv run /tmp/fitdnuvo_scanner.py /tmp/fitdnuvo_F1_25.exe

# JSON output for automated processing
uv run /tmp/fitdnuvo_scanner.py /tmp/fitdnuvo_F1_25.exe --json

# Denuvo preloader analysis
uv run /tmp/fitdnuvo_scanner.py /tmp/fitdnuvo_preloader_l.dll

Output

• stdout: Formatted report with progress bars per category
• JSON: /tmp/fitdnuvo_report_<filename>.json with complete structure

---

JSON Report Structure

{
  "file": "/tmp/fitdnuvo_F1_25.exe",
  "size": 399280512,
  "image_base": "0x140000000",
  "entry_point": "0x189ed020",
  "denuvo_score_pct": 14.5,
  "verdict": "DENUVO CONFIRMED (393MB VM payload)",
  "sections": [
    {
      "name": ".tls",
      "virtual_address": "0x6f9b000",
      "virtual_size": 296024419,
      "entropy": 6.85,
      "flags": "XRW"
    }
  ],
  "denuvo_regions": [
    {
      "section": ".tls",
      "confidence": 0.98,
      "reason": "[282.3MB] MASSIVE TLS section with XRW flags — Denuvo VM payload"
    }
  ],
  "engine_regions": [...],
  "fingerprint_matches": ["Anti-Debug", "Registry"],
  "import_summary": {
    "kernel32.dll": 302,
    "user32.dll": 94,
    "steam_api64.dll": 11,
    "sl.interposer.dll": 15
  },
  "summary": "============================================================\n..."
}

---

Fingerprint Categories

Category	Signatures	Weight
Core VM	NtAllocateVirtualMemory, NtCreateSection, NtMapViewOfSection, NtProtectVirtualMemory, RtlAllocateHeap	High
Anti-Debug	ZwQueryInformationProcess, GetProcessWindowStation, SetWindowLongPtrW, ...	High
License Validation	ZwCreateUserProcess, ZwCreateThreadEx, ...	Medium
File I/O	ZwCreateFile, ZwDeleteFile, NtOpenFile, ...	Medium
Registry	RegGetValueW, RegOpenKeyExW, ...	Low
System Info	ZwQuerySystemInformation, RtlQueryEnvironmentVariable, ...	Low
Process Introspection	LdrGetProcedureAddress, LdrFindEntryForAddress, ...	High
Crypto/Integrity	MD5Init, MD5Update, ...	Medium
Red Flags	Pie (GDI32), MessageBoxW, RtlAppendUnicodeToString, ...	High

---

Structural Heuristics

Heuristic	Confidence	Description
H1: Massive TLS	98%	.tls section > 10MB with XRW = Denuvo VM payload
H2: High entropy	90%	Entropy > 7.5 = packed/encrypted code
H3: XRW	85%	Executable AND writable section = self-modifying JIT VM
H4: Suspicious name	60%	Non-standard names (.sbss, .00cfg, .srdata, etc.)
H5: Executable BSS	75%	Section with "bss" in name marked as executable
H6: Bootstrap stub	70%	Tiny executable section after massive sections

---

Known Results

preloader_l.dll

• Score: 71.0%
• Verdict: DENUVO DETECTED
• Core VM: 5/5 (100%)
• Process Introspection: 9/9 (100%)
• Anti-Debug: 8/9 (89%)
• Red Flags: 5/5 (100%)

F1_25.exe

• Score: 14.5% (import) + structural confirmation
• Verdict: DENUVO CONFIRMED (393MB VM payload)
• Denuvo Regions: 9 (393MB)
• Engine Regions: 8
• Largest hit: .tls (282MB, 98%)

---

See Also

• fitdnuvo-denuvo-analysis — Complete Denuvo architecture analysis
• chicotv — PC Windows com F1 25