FitDNuvo — Standalone Initialization Chain Mapping

Date: 2026-06-29 Status: In progress — SPEAR/loopback protocol analysis phase Goal: Complete F1 25 standalone (no Steam, no EA servers, with GPU and functional save)

---

Current State

What WORKS

• ✅ Goldberg Steam Emulator — steam_api64.dll replaced, SteamAPI_Init returns true
• ✅ Preloader V4 — Original DllMain (UD2 traps intact), preloader_link_func → ret 1
• ✅ TLS Callbacks — CB0, CB1, CB2 execute normally
• ✅ Process starts — 423MB RAM, 9 threads, 80 modules
• ✅ TCP Server — port 47584 starts and accepts connections

What DOESN'T work

• ❌ GPU never initializes — D3D12CreateDevice is never called (0% GPU)
• ❌ SPEAR stub — EAAntiCheat.GameServiceLauncher.exe replaced with stub that just exits
• ❌ Loopback handshake — engine ↔ Denuvo VM on port 47584 is ESTABLISHED but stuck

Current blocker

F1_25.exe (423MB, 9 threads)
  ├── Server TCP 0.0.0.0:47584 (LISTENING)
  ├── Client TCP 172.25.128.1:47584 ↔ 172.25.128.1:60704 (ESTABLISHED, stuck)
  └── Engine waiting for response from Denuvo VM on loopback

Chain Map

Windows Loader
  │
  ├── TLS Callback CB0 (0x8f1b5f0, .tls XRW) → Denuvo VM bootstrap
  │     └── Allocates VM memory, starts TCP server :47584
  │
  ├── TLS Callback CB1 (0x18e20, .sbss XR) → Engine init
  │     ├── CALL 0x18d30 (.sbss)
  │     └── CALL 0x5370860 (.sbss)
  │
  ├── TLS Callback CB2 (0x1355af90, .tls XRW) → License validation
  │     ├── LoadLibrary("preloader_l.dll")
  │     │     └── DllMain → UD2 → SEH handler → init SPEAR + VM context
  │     ├── GetProcAddress("preloader_link_func")
  │     │     └── RET (eax = status) ← our V4 patch: mov eax,1
  │     └── LaunchProcess("EAAntiCheat.GameServiceLauncher.exe")
  │           └── SPEAR stub → exit(0) ← BLOCKER: no handshake
  │
  ├── main() / WinMain
  │     ├── SteamAPI_Init() → Goldberg → true ✓
  │     ├── ... engine init ...
  │     ├── D3D12CreateDevice() ← NEVER REACHES HERE
  │     └── Render loop
  │
  └── [BLOCKER] Engine thread waits for response from Denuvo VM on port 47584

Chain Components

Component	Size	Status	Action
F1_25.exe	399MB	Original	Patch: TLS callbacks (optional?)
preloader_l.dll	46KB	V4	Patch: preloader_link_func=1 ✓
steam_api64.dll	299KB	Goldberg	Replaced ✓
EAAntiCheat.GameServiceLauncher.exe	17MB	Stub 515B	Needs stub with handshake
EAAntiCheat.GameServiceLauncher.dll	48MB	Original	Analyzing protocol
EAAntiCheat.cfg	~14KB	Original	Analyzing configuration
steam_appid.txt	-	3059520	Created ✓

Next Steps

1. Port 47584 protocol — discover handshake format
   • Ghidra analysis of SPEAR DLL (agent running)
   • Active port probing (agent running)
2. Spec-compliant SPEAR stub — implement correct handshake
3. GPU test — verify D3D12CreateDevice after handshake
4. Save test — verify local saving
5. Final cleanup — remove unnecessary components

See Also

• fitdnuvo-denuvo-analysis — Complete Denuvo architecture analysis
• fitdnuvo-scanner — Automated PE Scanner