For months now, the digital rights management solution known as Denuvo has proven utterly impervious to cracks and workarounds—so impervious that a major piracy group warned games may become completely "crack-proof" within two years (that same group later took a public break from even attempting any more single-player hacks). In recent days, however, the first cracks have started to develop in Denuvo's digital armor (pun intended).

Denuvo works by creating a unique key for a game based on the specific hardware configuration of the legitimate purchaser's machine. If those game files are shared with another player using another computer, Denuvo's protection will detect the hardware differences and make sure the game doesn't work as intended.

Over the weekend, a hacker going by the handle Voksi crafted a workaround for this protection by building off the demo for id Software's recent Doom remake. Using a custom loader program, Voksi managed to swap the Steam AppID for a pirated copy of the full Doom game with that of a legitimately downloaded free demo. With that change, Steam and Denuvo apparently viewed the full game as if it was the legitimate demo and allowed it to load without issue. The same essential workaround was adapted for other Denuvo-protected games, including Rise of the Tomb Raider.

While Denuvo managed to fix this hole in its protection a couple of days later, it was still a major victory for those working to get around the previously unbreakable DRM. On a discord channel, Voksi wrote that his server logs registered more than 650,000 using his "bypass" in just three days.

Just as Denuvo patched up one hole, though, another more serious one has already developed. Yesterday, a hacker going by the handle CONSPIR4CY (aka CPY) released a fully cracked version of Rise of the Tomb Raider (we won't link to it directly, but here's a Reddit discussion of the crack and its readme file). There's not much info on how CPY's crack works at the moment, and other Denuvo games have yet to be publicly cracked for now. So it's unclear how easy this new circumvention will be for the firm to fix.

Still, the weekend's events mark the first major vulnerabilities for a protection scheme that, up until now, had remained impervious for months. That Denuvo lasted this long is still noteworthy in a day and age when many if not most prominent releases are fully cracked on their first day of availability. But with the crackers now scoring their first hit on Denuvo, it looks like the gold standard in DRM will be subject to the same cat-and-mouse game of break-and-fix as every other protection scheme.