A brief history of Denuvo DRM and the new hypervisor bypass — inside the cat-and-mouse game between Denuvo and the piracy scene

Last week, Denuvo made headlines, but for all of the wrong reasons. A freshly minted hypervisor bypass renders Denuvo's famous anti-tamper protection virtually useless to those willing to go to the lengths that the crack requires. For those not in the know, Denuvo is an anti-tamper and DRM software developed by Irdeto, which has been deployed across a huge number of PC gaming titles, sometimes with controversial results. Previously, it was considered difficult, or near impossible, to crack the DRM. Now, it's been blown wide open, due to the freshly minted Denuvo hypervisor-based bypass.

This method has allowed game cracking and distributing pirates (collectively known as "the scene") to once again release DRM-free versions of popular AAA titles on release day, known as zero-day releases. Naturally, this doesn't bode well for Denuvo and its parent company, Irdeto, for whom the DRM is a major earner.

We should note that the language in "hypervisor-based bypass" is specific, as actual cracks of recent Denuvo versions have yet to be published. A 'proper' crack would alter the game's executable code to remove or disable its DRM, while a bypass keeps the game mostly intact but adds an external avoidance mechanism.

This distinction is key with the hypervisor bypass (HVBP), as it requires drastic measures from gamers downloading pirated releases. One needs to disable almost every Windows low-level security feature — an exceedingly poor idea on its own — as well as install a scene-made hypervisor (HV), which Windows itself then sits on, to intercept Denuvo's checks. Gamers can easily enable these features after playing, but chances are, few will bother.

Any HV, whether it's VMWare ESXi, Hyper-V, Xen, or this Denuvo bypass, has access to the system at the metal level, with complete reign over the computer and all its data and hardware. Even trusting the scene's programming acumen, if the releases using HVBP prove popular, we're talking at least hundreds of thousands of systems with all defenses down and a nearly hardware-level threat vector. An unintentional bug in the HV can be exploited by malicious actors in an essentially untraceable manner.

Denuvo's reputation amongst enthusiasts

Ever since its inception circa 2014, Denuvo Anti-Tamper (not to be confused with Denuvo Anti-Cheat) has been under fire from gamers for its heavy-handed approach. The software is notorious for punishing legitimate customers, thanks to measures including hardware fingerprinting with limited activations, requirements to periodically reach out to Denuvo's servers, and finicky online validation that may brick many single-player titles if the activation servers ever disappear.

Every single one of those measures has caused perennial headaches for gamers, necessitating YouTube tutorials and other community help to let someone just enjoy a game they already paid for. But perhaps the most contentious of all is the performance hit thanks to the constant hardware verification, adding stuttering and lowering FPS, sometimes to the point of making some games unenjoyable in weaker machines. Denuvo has voraciously defended these reports, claiming that the DRM does not impact performance.

Regardless of optics, Denuvo has been able to stay one step ahead of crackers more often than not during the past decade. Whereas simple CD-checks of yore could be bypassed in an afternoon by someone with middling skills, combating Denuvo's thousand-layer approach requires a particular combination of technical acumen, patience/stubbornness, and free time — not an easy combination to come by, at least for free.

The cat-and mouse race against piracy

After its 2014 launch, it took crackers about a month to snap Denuvo, a timeframe almost unheard of for the scene. After a quick upgrade, Denuvo 2016 (the version naming is ours and not official) earned itself about a year and a half of immunity, with the main crackers almost giving up, until a rally in 2017 made zero-day releases the norm again. Around 2018, Denuvo applied its VMProtect obfuscation layer, making crackers once again work for weeks or even months to clean one title, though the scene's efforts accelerated to a full crack in 2019, resetting the scales once again.

After more Denuvo updates, the period between 2020 and 2025 was perhaps the driest for the piracy scene, given that apparently only two crackers (Empress, then voices38) were actively working on Denuvo, at a steady but undoubtedly slow pace. The vast majority of games remained uncracked, and those that fell to the attacks did so well after their original release dates. It was not until late 2025 that a new challenger appeared, in the form of the MKDev collective.

In December 2025, MKDev released a proof-of-concept of an HV bypass for Persona 5 Royal, with accompanying documentation describing how it all worked, using publicly available documentation and open-source hardware. This led to multiple community efforts applying that research, with the first notable release being Borderlands 4. More recently, Resident Evil: Requiem was a zero-day crack (one hour to be precise), and Crimson Desert was circulating in piracy circles the same day it launched.

Even the HVBP itself evolved somewhat, as the first version even required users to disable Secure Boot entirely and use EfiGuard to tweak the boot process, in addition to the aforementioned steps. Due to the concerning nature of the requirements surrounding the HVBPs, even its own makers alert users to the necessity of using the provided scripts to re-enable all the security features once they're done playing.

Popular repackers within the scene initially refused to carry HVBP releases, eventually changing their tune after the requirement to disable Secure Boot and use EfiGuard was removed. Even still, the HVBP games are clearly marked as such by both release groups and repackers. Meanwhile, voices38, the only known cracker working on contemporary Denuvo, already has 2025's Doom: The Dark Ages under their belt.

For its part, Denuvo has promised that it's increasing the product's security, and notably that it'll do so without further encroaching on gamers' systems. Despite its intensity, unlike some other copy protection methods of yore, Denuvo currently doesn't install any drivers and runs like any other application in ring 3 of the operating system, a fact that led HVBP releaser Kirigiri to posit that Denuvo will never be able to properly detect the HVBP, since that runs below Windows itself.

Denuvo ultimately helps PC game sales

The argument can also be made that, all things considered, until now, Denuvo has historically succeeded in its intended purpose. The mission of PC DRM has long been stated as protecting a game's initial sales weeks, particularly for highly marketed AAA releases that make the vast majority of their money around release date. As historical records show, Denuvo has been successful more often than not.

Normally, tangible and coherent information on the financial effectiveness of Denuvo is quite hard to come by. In 2024, the University of North Carolina released a study comparing sales-over-time of games protected with Denuvo versus those that got cracked.

The picture the data painted was pretty clear: a cracked game nets about 20% less total revenue in the first 12 weeks (three months) after release, with a strong correlation between the crack release date and the start of comparative revenue loss.

However, the study's author also notes that once those three months go by, it's borderline irrelevant for revenue whether a game is cracked or never had any DRM to begin with. Given Denuvo's well-known tendencies to cause performance and technical issues, some publishers have started removing it from their games right on or around the release day (Doom Eternal, Two Point Hospital, Devil May Cry 5) or some time after (Monster Hunter World, Resident Evil Village, NieR: Automata)

Most removals can be justified by the availability of cracked or DRM-free versions of the game, or due to community outcry, but it also likely benefits the publisher. Some reports claim that Denuvo's contracts include monthly and/or per-activation charges, which go away once the software is stripped.

Furthermore, any titles that never had Denuvo removed, including the HVBP releases, will be hard to archive, as at some point in time, the activation servers will vanish, and the games will otherwise become bricked.

Additionally, integrating Denuvo is both difficult and full of performance traps. Not only is Denuvo heavy to begin with, but it also takes effort from developers in crunch time to implement it effectively. Even then, the software's VM-obfuscation approach can undo weeks if not months of careful optimizations.

It also gets kind of ridiculous if you think about it: under normal conditions, a PC runs a Hyper-V, which runs Windows 11, that runs the game executable, that runs a Denuvo virtual machine, that then finally runs the game code (or parts of it). The analogy of software to onions has never rung truer.

Even still, with AAA game releases that amount to hundreds of millions, if not billions of revenue, that 20% slice is very hard to ignore — and so the cat-and-mouse game continues.