Hacker group RUNE has announced the release of an unusual version of Assassin’s Creed Phantoms, whose key feature is to completely remove the Denuvo and VMProtect protection systems from the game’s executable, rather than bypassing their standard. The author describes this version as Proof of concept — Demonstrate the technical possibilities of deep processing of protected software.
According to the official description, the experts did a huge job: they deleted 34 virtualized VMProtect blocks and about 200 Denuvo elements, recovered 261 obfuscated code segments, and reconstructed about 25,000 so-called Stolen functionality.
In addition, the PE directory structure has been fully restored (including import, export, exceptions and TLS), which allows the executable to be restored to its original state without the use of secure elements.