Denuvo Mobile Protection reverse engineering

What Denuvo documents

Irdeto lists integrity verification, anti-debugging, hook detection, root detection and emulator detection among its mobile protection features. That list describes product features, not the exact checks in a given APK. A function name or return value must come from the build being examined. Irdeto’s mobile protection overview.

Find where execution stops

We record the app version, package signature, install source, ABI and device state. An unmodified run gives us the reference for later tests. We then trace startup, sign-in and the rest of the app, noting which checks run before each request.

An exit before a network call calls for a different investigation from a server rejection. The first requires logs and the branch that stops execution. The second requires the sent bytes, session state and response. Changing a return value without tracing its callers gives no proof that the request is valid.

Connect protection checks to API values

A check can stop execution, change a stored value or affect a later request. We follow its output into callers, storage and request builders. This establishes whether it controls local execution or supplies data checked by the backend.

For each generated field, we record its source, lifetime and exact encoding. Signatures need the signed bytes and key source. Encrypted bodies need the cipher mode, IV or nonce, padding and authentication tag. Session fields need the request that creates or refreshes them. These records become tests for the delivered clients.

Verify the finished clients against the APK

Tests cover successful calls, expired sessions, changed inputs, errors and multi-request sequences. We compare parsed results and generated bytes across Python, JavaScript/TypeScript and Postman. Random nonces and current timestamps are checked against the protocol rules rather than compared to an old capture.

Android Keystore keys can be non-exportable and bound to secure hardware. A server that requires proof from that hardware has a runtime dependency that copied code cannot remove. We check this during the APK review and state the deployment requirements before the quote. Android Keystore documentation.

Related work: native libraries and JNI, request signing and protected APKs.

The full APK is the project

You receive Python, JavaScript/TypeScript, Postman and API documentation for the full application. The work covers endpoints, authentication, request signatures, encryption, decryption, sessions and backend workflows.

Run the complete public demonstration to inspect one matching workflow in every format.

Send the APK on WhatsApp or email. The 24–72 hour delivery window starts after we receive the APK and any account access needed to run it. The fixed quote states the deadline. Most projects finish sooner.