Search Unity

  1. Unity 2018.3 is now released.
    Dismiss Notice
  2. The Unity Pro & Visual Studio Professional Bundle gives you the tools you need to develop faster & collaborate more efficiently. Learn more.
    Dismiss Notice
  3. We've updated our Terms of Service. Please read our blog post from Unity CTO and Co-Founder Joachim Ante here
    Dismiss Notice
  4. Want to provide direct feedback to the Unity team? Join the Unity Advisory Panel.
    Dismiss Notice
  5. Improve your Unity skills with a certified instructor in a private, interactive classroom. Watch the overview now.
    Dismiss Notice

How to protect your assets from tools like "Asset Bundle Extractor"?

Discussion in 'General Discussion' started by Aseemy, Apr 25, 2017.

?

Do you encrypt your data?

Poll closed May 9, 2017.
  1. Yes.

    13.3%
  2. No, dont know how.

    13.3%
  3. No, there is no need because data stealers dont make successful games

    66.7%
  4. No, it increases development time

    13.3%
  5. No, its too expensive

    26.7%
Multiple votes are allowed.
  1. Aseemy

    Aseemy

    Joined:
    Aug 22, 2015
    Posts:
    100
    There is a tool Asset Bundle Extractor with which you can steal assets from other apk files. I used it on my published games and was able to extract all textures.
    This tool is not able to extract textures from this game Neo Monsters.

    I am not asking for a method to extract assets from this game but i am asking for the method this game is using to hide their assets so i can do the same with my game.

    I understand highly motivated people can still steal assets using various ways but this tool can be used by anyone so i want to protect my data from it.
     
    Last edited by a moderator: Apr 26, 2017
  2. zombie_psy

    zombie_psy

    Joined:
    Oct 9, 2012
    Posts:
    62
    The topic of extracting / decompiling other games assets pops up every once in a while. If you search around and read peoples responses, it's general concensus is always the same. You can get other game's assets and code GIVEN to you but you still won't create a good game, profitable game, game giving you unfair advantage, etc. The most you'll get out of it is an education on how someone produced their assets. But you don't even need to rip a game's assets to find that information out.

    It comes down to is your own ability and skill to CREATE YOUR OWN a game that other people enjoy. Assets don't even really matter. There's other factors as well, like inflating statistics, fake marketing ads, etc, to make an unenjoyable game LOOK like it's being enjoyed by masses of people, but that's getting way off topic haha
     
    Last edited: May 1, 2017
    EternalAmbiguity likes this.
  3. wccrawford

    wccrawford

    Joined:
    Sep 30, 2011
    Posts:
    2,022
    I am, in general against trying to prevent this kind of things because it's time-consuming and largely pointless.

    Final Fantasy Brave Exvius (JP version) started encrypting their assets a while ago. I believe this was to prevent people from ripping the assets early before an update and then posting them online, ruining any surprises.

    It failed pretty badly. There are fewer people able to rip the assets now, but the 1 guy that's really good at it posts all of them online in the subreddit every time now. It's like the Streissand Effect.

    If FFBE can't prevent it, then I really don't think an Indie can.

    But back to the question... If you want to prevent asset ripping, you'll probably have to come up with your own asset handling functions. Something that will take in raw data and turn it into textures at runtime. This will probably essentially break the Unity Editor, making it rally hard to use it to create your game, though I suppose it might be possible to make scripts to fix that, too. It'd be a *ton* of work, I think, and slow you down in most aspects of game creation *forever*.
     
    Ryiah, Socrates and Martin_H like this.
  4. neginfinity

    neginfinity

    Joined:
    Jan 27, 2013
    Posts:
    6,421
    I think a better idea would be to allow data extractions so people can mod the heck out of your game. Successful mod scene can bring more cash.
     
    Ryiah and Socrates like this.
  5. drewradley

    drewradley

    Joined:
    Sep 22, 2010
    Posts:
    3,059
    To paraphrase some baseball movie I never saw:
    "If you build [better encryption], they will overcome [it and upload it anyway]."
     
  6. Kiwasi

    Kiwasi

    Joined:
    Dec 5, 2013
    Posts:
    16,058
    Ultimately you have to send instructions to the CPU and models and textures to the graphics card. That means there will always be a way to rip the data.

    DRM traditionally hurts legitimate users more then it slows down hackers.

    I'm not advocating leaving the door open because locks can be picked. But there is no point spending a million dollars on the lock if an intruder can break a window.
     
    Ryiah, roojerry and Martin_H like this.
  7. GarBenjamin

    GarBenjamin

    Joined:
    Dec 26, 2013
    Posts:
    7,380
    Yeah might make as much or even more sense to include a .zip all of your asset files along with a text document listing all of them and encouraging people to use them.

    The thing is it's basically like "laws"... they do nothing to stop the true criminals and only serve as a nuisance for the rest of the people to have to learn all of them.
     
  8. EternalAmbiguity

    EternalAmbiguity

    Joined:
    Dec 27, 2014
    Posts:
    2,133
    Ding ding ding.


    Making it easier to get into Unity assets after-the-fact would make it easier to fix screw-ups in games I own. Sometimes they can be circumvented with regedit but that isn't always the case.
     
  9. Le_Tai

    Le_Tai

    Joined:
    Jun 20, 2014
    Posts:
    262
    EternalAmbiguity and Socrates like this.
  10. hallsofcamelot

    hallsofcamelot

    Joined:
    Oct 16, 2013
    Posts:
    85
    I am not sure why you would need to encrypt the entire asset bundle.

    Maybe you could encrypt a few kilobytes of the bundle... maybe beginning, middle and end... enough to break the tool.

    For that matter, you probably wouldn't even need encryption if you moved some blocks of data around. Maybe take 2k bytes off the header and resurrect the correct byte array later.

    Then again, maybe you can replace 1024 bytes somewhere in there with zeroes and then replace the zero's with the correct values at runtime.

    I guess the point is that there are about agazillion things you could do that should protect* the data and be efficient as well.

    Thanks!
    Brian
     
    Last edited: May 3, 2017
    mowax74 and wccrawford like this.
  11. Ryiah

    Ryiah

    Joined:
    Oct 11, 2012
    Posts:
    12,848
    Which would then be extracted at runtime. Like we frequently bring up in threads of this nature, at best DRM only slows down the rate at which people extract resources. At worst it brings with it consequences that hurt legitimate users who simply want to play your game.
     
    wccrawford and hallsofcamelot like this.
  12. hallsofcamelot

    hallsofcamelot

    Joined:
    Oct 16, 2013
    Posts:
    85
    Well, obviously, the point isn't to have full-proof security.

    I thought the point was to discourage the use of the "Asset Bundle Extractor".

    There are obviously a lot of different ways to think about this.

    I lock my car when I leave it.

    Not because I think that no one can get into it.

    But to dissuade the 99% of people who just move onto the unlocked one.

    Cheers!
    Brian
     
    CloudWeight, crudeMe and mowax74 like this.
  13. Ryiah

    Ryiah

    Joined:
    Oct 11, 2012
    Posts:
    12,848
    What's stopping the author from modifying his tool to support runtime extraction? Or the person who wants to extract the resources from simply grabbing one of the existing tools that handles that specific style of extraction? You might discourage the people who were merely curious but at the same time those people were never truly a threat to begin with. The people who were a threat will not be deterred at all.

    If you had a custom radio installed you would remove the front panel and carry it with you too. Because a lock by itself is simply not sufficient to deter someone who wants to steal something of actual value. People who open the door on the off chance you left something valuable in there aren't really the people you need to worry about.

    People you need to worry about know how to get into your car without a key, start it without a key, and drive off.
     
    Kiwasi likes this.
  14. hallsofcamelot

    hallsofcamelot

    Joined:
    Oct 16, 2013
    Posts:
    85
    I am not on a holy crusade to change anyone's mind about anything.

    You do what you want, I could really care less.

    My intention was to answer the original OP's question

    > I understand highly motivated people can still steal assets using various ways but this tool can be used by anyone so i want to protect my data from it.

    What is your intention?

    Thanks!
    Brian
     
    CloudWeight and mowax74 like this.
  15. Ryiah

    Ryiah

    Joined:
    Oct 11, 2012
    Posts:
    12,848
    My intention is to let them know they're wasting their time because (a) people who just want to show their friend they could extract an asset for giggles aren't a threat, and (b) people who wanted to steal an asset to resell it will find a way to do so regardless of the technique employed.
     
    Kiwasi and neginfinity like this.
  16. Ryiah

    Ryiah

    Joined:
    Oct 11, 2012
    Posts:
    12,848
    A funny thought occurred to me. Are you positive there are textures in the included APK? Because while it's obvious that you can download an asset bundle at runtime (it's one of the primary features), it may not be as obvious that you can clear the asset bundle from the cache whenever you want.

    https://docs.unity3d.com/ScriptReference/Caching.CleanCache.html

    Seriously doubt they would approach it in this manner though. It's more likely they're using a method similar to uCrypt.

    https://forum.unity3d.com/threads/u...s-files-etc-from-local-or-web-storage.145705/

    Just keep in mind that if you do decide to encrypt your assets you may want to obfuscate the decryption code too.

    https://www.assetstore.unity3d.com/en/#!/content/48919

    By the way at best we can only guess at the method they are using. If you want the exact method you'll need to ask them.
     
    Last edited: May 3, 2017
  17. BuckyLuis

    BuckyLuis

    Joined:
    Jan 4, 2016
    Posts:
    299
    no, encryption sucks, all computer information should be free and open to everyone

    the computer was made to decrypt (the nazi enigma machine), it is the spirit and fundamental nature of computing to decrypt and make information free and infinite to all people

    it sucks unity sorta obfuscates your assets and stuff and has no built in easy way to bypass it :/
    it sucks i have to take extra time to expose my game (to modding, like, an extra 4 months of dev time)
    hmm i wonder if i can bundle that tool with my game? (regardless, i desired to overcome it of my own ability)
    (modding is the best!)
    uh... i guess i could distro my source aswell?? .. is that a bad idea? lol .. i actually dont really even care...

    seriously, the soul of the computer is to make information infinite and free to all, by desiring to use the computer to make creations, you must bow to the soul of the innovation of the computer or do not get into it at all

    ...the laws were probably made by old people that know jack crap about computers, they only knew about finite material trades business laws.... and/or scammers that prey on the weak (as is the nature of capitalism)
     
    Last edited: May 5, 2017
    paulomuggler likes this.
  18. Meltdown

    Meltdown

    Joined:
    Oct 13, 2010
    Posts:
    5,356
    This looks good, but there is no contact information for the author, either on that store page, or their website.
    Unity needs to clamp down on this for the asset store, and require a compulsory contact email address or contact form.
     
  19. BuckyLuis

    BuckyLuis

    Joined:
    Jan 4, 2016
    Posts:
    299
    LOL do you have a link to a current type of tool like this that actually works??
    i just googled and tried like 4 different tools like this and none of them work on my compiled game! (at all!)

    really sad ... i want a tool like this...

    guess none of em work with the unity 5.5 beta (thats the version my current project is on)
     
  20. mowax74

    mowax74

    Joined:
    Mar 3, 2015
    Posts:
    22
    People should find out for themselves if it is a waste of their time and how much time is acceptable to invest in a basic secure of their asset bundle data.

    And its not always a game, that comes out of unity. sometimes these are realtime visualizations, where not everyone should be able to steal that data THAT EASY.
     
  21. Ryiah

    Ryiah

    Joined:
    Oct 11, 2012
    Posts:
    12,848
    Fortunately there is valid contact information in the WHOIS. But I agree they need to retroactively require that stuff.

     
    Meltdown likes this.
  22. Meltdown

    Meltdown

    Joined:
    Oct 13, 2010
    Posts:
    5,356
    I ended up buying this one
    https://www.assetstore.unity3d.com/en/#!/content/87431

    Excellent support from the author, and they quickly resolved any issues I had on Windows Store.
    Lots of features too, and there are 3 versions, free, base and pro.
     
    Ryiah likes this.
  23. DavidLieder

    DavidLieder

    Joined:
    Feb 14, 2016
    Posts:
    65
    That really has nothing to do with the question. He wants to know how to protect assets, as do I.