Bethesda apparently broke its own Denuvo protection for Doom Eternal | Hacker News Reader

Bethesda apparently broke its own Denuvo protection for Doom Eternal

arstechnica.com

84 pointsTomte60 comments

This is good news, Denuvo (the evolution of SecureROM DRM) was found to cause performance issues in games, inlcuding spiking the CPU and tons of excessive writes, which may reduce the lifespan on SDDs:

https://www.extremetech.com/gaming/282924-denuvo-really-does...

Interestingly, Denuvo was the cause of one of the most annoying bugs I've ever had to look at. A crash bug which only appeared after applying their patch to the executable.

Anyone remember the Unreal Tournament 2003 (or was it 2004?) Demo, which had an exe that was compatible with original retail release as a DRM free copy.

Of course, Unreal Tournament was a mostly online multiplayer game, and relied on cdkeys as well.

I'm surprised with everything i've heard about release pressure and crunch time that this doesn't happen more often.

For the original unreal tournament (1999) you could download the demo and then apply the "nodelta" official update to get the full version of the game.

I remember installing a copy of QuarkXPress (3.1 I think?) way back in the day. It was an upgrade copy, so it wouldn't install unless I pointed it to an existing QuarkXPress executable, but it was a freshly installed system so I didn't have one handy (and didn't fancy digging out the original floppies for 3.0).

On a whim, I pointed the installer to the application on the install floppy, which it happily accepted and proceeded with the installer.

TL;DR bad DRM has existed since DRM existed.

Anyone else remember the DOS days where you would start an application and it would tell you in a cryptic font "Pg351, P2, Ln3, Ch3 thru 10" and you would just have to know that meant you had to open the user manual to page 351 and type characters 3 through 10 from line 3 paragraph 2.

Then there were some creative ones like B-17 Flying Fortress which had a paper decoding tool where you slid the paper rings to match the symbols on the screen. This revealed another symbol through a hole in the paper that you selected on the computer from a list to "prove" you had a legitimate copy of the game.

Old XCOM-UFO Defense had this too. Also my first experience with a hex editor to remove tedious DRM by setting the expected words in the binary to 'xxxx'.

Leather Goddesses of Phobos had a Scratch n Sniff version.

And although not exactly copy protection, Leisure Suit Larry had a great "Age Check"

https://en.wikipedia.org/wiki/Leather_Goddesses_of_Phobos

http://allowe.com/games/larry/tips-manuals/lsl1-age-quiz.htm...

Oh man! If I recall correctly, Prince of Persia was perhaps this way on the Mac? I have the vaguest memory of some stapled , crinkled, photocopied pages as reference...

They didn't "break" anything, someone screwed up and left the unprotected executable accessible.

I have really enjoyed GOG lately for the lack of DRM

> That 67MB file can reportedly replace the 370MB, DRM-protected executable in the main game folder with minimal effort and no practical effect on playability.

What other things is that 370MB executable doing that it needs to be over 5½ times as large as the game itself? Sending every keystroke home? Searching the hard drive for crimethink? Running a Bitcoin miner?

Mostly just obfuscation, but obfuscation via injecting more code rather than just symbol mangling. It's designed to ram tamper checks & other validation all over the place, making it hard to identify & remove.

And if you're thinking "but surely all that injected overhead would slow the game down?" then yes that's absolutely correct, it does: https://www.extremetech.com/gaming/282924-denuvo-really-does...

I don’t understand the relationship between the two companies, id and Bethesda. I see that they’re both owned by ZeniMax but nothing else. Is this just a temporary marriage of convenience?

There are two Bethesdas. Bethesda Game Studios is a developer and makes Oblivion and Skyrim and so forth. Bethesda Softworks is the publisher for the ZeniMax-owned development studios like BGS and id.

> convenience

id: focus on game development that people enjoy playing

bethesda: do whatever bethesda does apart from trying to understand why people enjoy playing games.

My bet is that id guys just dont care much about being marketing monkeys.

While ZeniMax owns both companies, Bethesda is the publisher

A similar thing happened with Rage 2. Soon after release, they removed the protection. Here's a hoping the same thing happens here.

Someone is going to be fired over this.

This is going to cost them tens of millions of loss in sales.

Not really. Doom has enough of a brand name that the average person probably isn't going to say, "Great, now that I know a DRM-free version exists, I will pirate it!"

More likely, someone like me would just say, "Sweet! Now if I buy the game, I can get at a version that won't slow down my performance with all of the obnoxious DRM crap running in the background!"

This is part of why I quit PC gaming and took the plunge to Linux. It seems like every PC game recently requires a social login with its own launcher and a dedicated DRM rootkit. And the privacy policies for all of this stuff are very "permissive." After a certain point you realize you aren't in control of your own computer.

At least with consoles you _know_ going in that the manufacturer has every executable on lockdown. But I couldn't stomach _not knowing_ if some poorly coded DRM or RGB control service was opening up my private files to remote code execution[1].

[1]: https://twitter.com/gsuberland/status/1175570500292108289

Such a shame that Valve isn't pushing SteamOS harder (unless I'm missing something?) because they are in the best position to loosen Microsoft's stranglehold, not only in terms of the Windows platform but also controller support. Even when games do run on other platforms, they often only natively support Xbox-style controllers. I don't think this is an accident.

Please don't say PC when you mean Windows. Playing games on a Linux PC is still PC gaming.

(I play games on a Linux PC myself.)

It's gaming in the sense that racing in the Special Olympics is still racing. Sure, but for the purposes of the marketplace it may as well not exist unless you're talking about Linux+Android gaming.

It was my bad calling it "PC gaming." You're misinformed on this. Check out protondb.com - by opting into the Steam beta in Linux you can play Windows games, oftentimes with the same or better driver performance than in Windows. And sometimes not. But to liken it to the "Special Olympics" is a bit cruel and ignorant.

There are other valid perspectives than the marketplace's.

Not if the market's is also the colloquial definition.

Agreed. I gave up when everyone demanded that I install Steam.

I think it’s fair to say that you have a very naive view of the average human. I‘ll stick with the real data on piracy rates.

I think your own view that every game pirated is a lost sale is equally naive, so, to each his own.

I certainly don't believe this, but I doubt that the "I only pirate games to try them before buying" crowd is terribly large either. even fewer people are going to actually buy the game first and then download a pirated .exe to replace the original.

That group is not large but they weren't buyers to start with so they aren't counted as lost sales.

If this game is as good as the previous instalment in the series it won't make a difference. There are several types of players, the ones who buy games on launch day, those will still buy. The ones who wait for sales, those will still buy it, the pirates who try and then buy and those who only play cracked games. Only the latter group won't be buying the game and they weren't going to in the first place.

This may actually bring them additional millions in steam sales from additional exposure and playerbase.

A good number of people will buy this on Steam, which is a bigger lock-in than any other DRM.

Based on how many games using only the in-built DRM in Steam are cracked I'd guess that "lock-in" is really not that big of an issue, if at all. Other DRMs are far more invasive than the Steam DRM.

Who ever is in responsible on or for the team that made this mistake twice should be fired. Doing the same hugely expensive mistake twice in a row is ridiculous.

I would not say that this will necessarily be hugely expensive. People who would have waited for a crack would not have paid anyways. The only impact is them getting to play the game at the same time as everybody else.

> Denuvo says it still considers even a few days of effective DRM protection to be valuable to its publisher customers

This is a pretty ridiculous position and should be embarrassing if you work at Denuvo. Would you buy anti-virus software or any other security product with that claim. (Police officer to homeowner) I see you bought a lock for your front door that only offered two days of protection ... it's been 3.5 so we're not going to investigate and your insurance probably won't cover it.

I don't think you understand the point of this DRM. If one week of protection means that you sell 80,000 more copies of your game to people that are too impatient to wait for piratable version, it's worth it. Your analogy doesn't work.

If it’s free then sure, but your numbers are unlikely to be accurate and this stuff both directly and indirectly expensive. So, it’s easy for it to slightly increase sales and still be a net loss.

Basically most of the sales of the blockbuster games comes from the initial week or two, when people can't wait to get their hands on the game. The anti-piracy protection companies and the game companies know this, and that's why it's fine that the anti-piracy protection gets broken eventually. Just not when the game initially launched.

Preorders are a huge part of that initial sales rush. Clearly those are independent of if the game happens to be cracked on opening day.

If everyone expects the game to get cracked the same day, they might be less likely to pre-order in the first place.

It doesn't have to be free for it to be worth it. Let's take that 80,000 number. After Steam takes its cut that's $42 going to Bethesda's pockets per unit sold (worst case, ignoring the lowered fees as units sold increases). There's no further distribution costs, so that's a straight 80,000 * $42 = $3.3M of revenue. If Denuvo costs even $100k then it's already paid for itself 30 times over.

As for the 80,000 number, Doom 2016 sold 500,000 copies on PC in its first 2 weeks. You only need mid to high single digit percentage increase from DRM to turn into substantial amounts of money. Heck, if Denuvo costs $100k then even a 1% sales increase during that first 2 weeks would have been a net gain of $110k.

Denuvo likely costs vastly more than 100k, and the difference in samples are unlikely to hit 80k. Using 2 million for the software and 20k net sales I hit a net loss of 1.1 million.

Yep, those numbers where picked from thin air, but ”As of August 2018, the company employs 1,000 people“, so that math only works if their licenses are freaking expensive. https://en.wikipedia.org/wiki/Denuvo

> Acquired in January by digital platform security firm Irdeto, Denuvo has essentially grown from a company of 45 people to over 1,000.

I believe that's saying that Irdeto has 1,000 employees, not that 1,000 people work on Denuvo itself. Instead it sounds like Denuvo "only" needs to cover the salary of around 50 people unless they've grown substantially since the acquisition as pre-acquisition they were 45 people.

I'm guessing they didn't jack up the licensing costs 10x since they were acquired, so using numbers for ~50 people a cost of $2M seems way too high. In 2017, so pre-acquisition, there were around 50 games using Denuvo: https://www.game-debate.com/games/gamesWithDenuvo

I'm sure the scale of the game influences costs and a AAA would be more than an indie release etc... but the math still works for numbers far lower than $2M licensing costs. And presumably Bethesda & others have done these analysis and concluded the licensing costs are worth it.

This is a poor example. Most locks - like most DRM - does not stop the most determined people from gaining access. It makes it slightly harder, more time consuming and/or more resource consuming to get access, with the hope that it will deter the most opportunistic attackers, and slow the more determined ones "enough" where "enough" is a function of the cost of the protection vs. the benefit of delaying access.

We accept that because we recognize that there is a cost/benefit tradeoff to be made to protection - it is relatively rare for a protection to need to be absolute to be worthwhile; in fact in a lot of settings protections that attempts to be "absolute" will be prohibitively expensive and/or complicated.

as they say, "Locks don’t keep robbers from stealing. Locks keep honest men from making mistakes."

A lot of DRM isn't like locks because a crack can be applied by casual enthusiasts, not just experts. Keygens are not hard to use, whereas lockpicks require a bit of skill, time, and equipment that you can't just download.

(Some DRM does actually act more like a lock, such as console DRM that require hardware mods and would void the warranty)

Lockpick guns aren't hard to use either and can be employed by casual enthusiasts, the idea that lockpicking is hard is a myth that comes from outsiders observing the hobbyist communities and failing to realize that they aren't devoted to simply opening locks but rather the cultivation of skills to open locks in a particular manner.

What you are betting on with a lock is not primarily stopping a lock-picker, but that most people are hesitant to force the door or break a window.

How hard can it be to protect AAA games when can't be bought or played without an internet connection? (Can't be bought because you don't buy stuff on physical media any more, and can't be played because there is a huge patch every 3 days that you'll need if you expect to be able to finish it).

Just make the damn thing require an internet connection all the time. I don't care. If you are a good publisher then you promise to remove this restriction after 1 or 2 years and enable offline play.

> Just make the damn thing require an internet connection all the time. I don't care.

Not everyone has perfectly reliable access to the internet.

Most people who can download a 50GB game tend to at least be able to have a connection that allows the game to phone home once a minute or so.

Maybe that person went to a place where they could get Internet, downloaded the game to a suitable storage medium and dragged it over from there into their steam folder at home.

I knew someone that worked on AAA games (for console). Even with day-1 updates they made single-player a priority during the final push because certain groups (they specifically called out those deployed overseas) can't get updates. Obviously, multi-player must update before playing.

once the game is cracked, the scene tends to be pretty efficient at posting patches. unless something nontrivial is happening over the connection, they can just emulate it locally.

One person buys it, downloads, uploads the files, others play it... not sure why physical media would be required for somebody to pirate a game.

Reply on news.ycombinator.com