Things look to be heating up in the war against (or indeed for) piracy. And it’s not surprising that Denuvo is involved in this latest development. The DRM company is reportedly working with 2K Games to implement a 14-day online check-in for certain games. This decision follows claims from those in the pirating scene that there are no more games with Denuvo that haven’t been cracked or bypassed.
First to mention the claim is prolific X account @Pirat_Nation, who mentions that the companies have added the check-in requirement to NBA 2K25, NBA 2K26 and Marvel’s Midnight Suns. The post references “recent reports”, but doesn’t point to any one specifically. It does mention that prior versions of the DRM only required a reauthentication “after significant system alterations”.
Crack VS Bypass
This claim follows one made by cracking group DenuvOwO that there are no more games with Denuvo that have not been cracked or bypassed. That being said, there is an important distinction to be had between these two, even if it’s not especially clear. The first is the circumvention of the DRM directly. The second is the exploitation of a flaw in the DRM’s programming to, in effect, sidestep it.
In the case of the latter, this involves a method called the Hypervisor-based bypass (HVB). And this method involves installing a kernel-level driver to intercept and respond to Denuvo’s checks. This, in turn, involves disabling Core Isolation and Driver Signature Enforcement. As it sounds, it’s not something that just anyone should try, simply for the safety of their system.
Getting back to the claims that all Denuvo games have been cracked or bypassed. From said announcement it looks like the latter list is by far the longer one. Which brings us back to the games that 2K Games added the 14-day online check-in to. Tom’s Hardware reports that this is something that’s impossible for HVB to bypass, as it should theoretically be impossible to replicate a request / response call to Denuvo’s servers.
DenuvOwO Claims Report Is Inaccurate
But over on Reddit, a user claiming to be a DenuvOwO rep claims that this is “far from the truth”. The user goes on to say that the crack for all three games mentioned above, as well as TopSpin 2K25, have been updated to have “the time spoofed to reflect a date where the old token is still valid”. This sounds like tricking the game into thinking it’s always within the 14-day window.
It’s worth noting that this 14-day online check-in measure was added after Irdeto, the current parent company of Denuvo, responded to the pirates’ claims. In a statement to TorrentFreak, Daniel Butschek, head of comms at Irdeto, says “we’re already working on updated security versions for games impacted by hypervisor bypasses. For players, performance will not be compromised by these strengthened security measures”. He added that addressing hypervisor-based workarounds will not require Denuvo to move into Ring -1 or deeper kernel level, and that is not in the direction we’re pursuing”. Though that claim about performance not being compromised is contentious at best, as many a gamer can attest.
While the arms race between DRM and piracy goes on, this is the second case of online check-in DRM being put in place. Over the weekend, PlayStation gamers have found that digital games bought digitally have a new 30-day online check-in requirement added. This can even break if the PS5 or PS4 is not connected to PSN servers, and the CMOS battery is removed or runs dry. It’s overall a very similar situation to what happened to the PS4 back in 2021.
(Source: @Pirat_Nation / X, Tom’s Hardware, Reddit [1], [2], TorrentFreak)
