About the anti-cheat
Reading your post kinda reminded me what I wanted to do all along. A while back, when Resident Evil 7 was out, there was some issue with Cheat Engine being detected superficially. Unsigning the executable seemed to do the trick, but then another game got out with similar anti-cheat: Sniper Elite 4 (if I recall). Two methods I know of were later made public: a) freezing a scan thread Denuvo kept running; b) patching a Windows API would also do the trick.
So I'll try to tackle them both
1) freezing the scan thread (if any)
Cheat Engine, open game process, Memory View > display threads list. Quite a bunch in there, so start investigating:
I checked each of them, looking at the entry point (RIP). No luck. So then I said to myself "why not try Process Hacker and suspend them one by one, starting with the lowest one in priority?" Did that as well, pausing as many threads as possible, to the extent of the actual GUI still working. Attached with x64dbg and no luck. Game still died. So figured it's an on-attach trigger.
2) the Windows API method - -
QueryFullProcessImageNameW
I tried this solution
[Link], but again, to no avail. Game still dies on attach.
If you can't access the post, here you go:
3) derivatives from the above
a) So I thought "how else can I trap Denuvo (or the anti-attach) before it actually kills the process?". Well, answer is in the post above. First-up, run the game and suspend the process. Then attach it with x64dbg in this state. Apparently, that didn't work as well.
b) How about.. running the game, attaching it with CE, breaking at common termination APIs (TerminateThread, TerminateProcess, ZwTerminateProcess, ExitProcess, etc.) - - suspending or not the process after all these steps? Some of them might break in CE when we attach with x64dbg
Hmm, nope, didn't seem to work.
c) How about.. first trying to debug the executable directly, then attempting the same via patching the EP to EB FE (infinite loop)? Then you'd want to run the process from x64dbg, restore the 2 bytes back to original and see what happens. Well.. this seemed to be the most effective way. Because..
So let's dig into where that pop-up came from. MessageBoxA/W break should do the trick. The W version did break indeed. One anti-attaching trick I know involves an OS API - ZwQueryInformationProcess. Time to break on it and see what it returns that Denuvo checks.. didn't get far in the VM.
d) then I patched the first 2 bytes to EB FE; ran the process, used CE, restored the bytes.. and what do you know.. there aren't any
integrity checks; there's just anti-debug/anti-attach.
Time to go more in-depth.
BR,
Sun
L.E.: Using
ScyllaHide and just attaching (not starting the process from x64dbg) works
Just remember to do this:
a) set the flags as such:
b) when first attaching and x64dbg pauses, remove these breakpoints:
[Link]'s the plugin already set-up. Just drop the content in your
x64dbg\x64\plugins folder
Enjoy
BR,
Sun