dearxan

dearxan is a library for static and runtime analysis and patching of the checks that Arxan (now GuardIT) inserts into a binary. According to the README, it can fully neuter Arxan in the FromSoftware games that use it: once patches are applied, no Arxan code (such as anti-debug and integrity checks) runs and encrypted functions remain decrypted. The README notes one caveat: the Arxan entry point stubs still have to run. Those stubs do not perform anti-debug checks, but in some games (for example Dark Souls Remastered) they perform integrity checks and can crash the game if modifications are detected. This can be mitigated by placing hooks in the callback passed to neuter_arxan. The author states that once the entry point stubs are fully reverse engineered, this will no longer be necessary. Tested games listed in the README: - Dark Souls Remastered - Dark Souls II SOTFS - Dark Souls III - Elden Ring - Armored Core VI - Elden Ring: Nightreign The crate is only tested against the Arxan variants in the latest versions of these FromSoftware games and may not work with Arxan configurations used by other developers. Contributions are welcome. Usage options described: - From Rust with the disabler feature: add dearxan to Cargo.toml and call dearxan::disabler::neuter_arxan once, ideally before the game's entry point executes. A callback receives the result and is a suggested place to install hooks. - From C++: download the static library from Releases, link it with the included Windows import libraries, include include/dearxan.h and call dearxan::neuter_arxan. Minimum supported standard is C++14, with C++17+ recommended. - From C: same library and header, call dearxan_neuter_arxan with a callback. - From other languages: generate C bindings from include/dearxan.h and call dearxan_neuter_arxan. The README warns that many DLL injectors or mod launchers do not suspend the process at creation or otherwise let code run before the game's entry point. The crate supports such loaders on a best-effort basis, but using one that loads mods before the entry point is strongly recommended. For Souls games compatible with me3, the crate is already integrated into that mod loader through the disable_arxan profile option, and using that is recommended if the mod already depends on me3. For writing a custom patcher (for example to patch an executable on disk), the README says you need to analyze Arxan stubs with dearxan::analysis::analyze_all_stubs or equivalent APIs, pass the resulting StubInfo values to dearxan::patch::ArxanPatch::build_from_stubs, and apply the patches manually. This must be repeated until no new stubs are found, because some games have encrypted stubs not discovered in the first analysis pass. For a live executable image, it is important that the Arxan entry point stub has been invoked; FromSoftware binaries may also be wrapped in SteamStub. The README describes Arxan features including instruction mutations and control flow obfuscation, encryption of sensitive functions at rest with decryption at execution time, anti-debug checks, and integrity checks that can write flags to a buffer, crash the game via stack or control flow corruption, or repair function code. Arxan logic is contained in stubs inserted into arbitrary game functions; these save context, run Arxan logic, restore context and jump back. The crate disables Arxan by finding these stubs and visiting their control flow graphs. It uses partial instruction emulation and forks program state at branches to work through control flow obfuscation, then analyzes stub structure to extract patches. These are usually a jump hook to a trampoline that fixes up the stub's stack, and sometimes include extracting decrypted code regions to write their contents directly. Feature flags: - disabler (default): provides a patcher that fully disables Arxan via neuter_arxan. - rayon (default): parallelizes stub analysis using rayon. - ffi: exports the C function dearxan_neuter_arxan. - instrument_stubs: builds on disabler by instrumenting each stub to log a message the first time it is called; the README warns this currently crashes for games other than Dark Souls Remastered due to register clobbering. - internal_api: exposes most internal binary analysis APIs through dearxan::analysis::internal; these are not stabilized and may break between minor versions. Credits mention dasaav for global synchronization for neuter_arxan, help reverse engineering how Arxan stores memory regions to decrypt, and finding the encryption algorithm (32-round TEA).