Discussion IL2CPP and Obfuscation

First off - of course no obfuscation is foolproof, nonetheless I would like to stop fools from being able to read the source scripts.

Given that IL2CPP creates native code, it would seem that hackers have little (easy) way to decompile into source. The mod site here has a question about IL2CPP: https://platinmods.com/threads/is-it-possible-to-deobfuscate-il2cpp-game.122359/
The start of the first answer:
Is it possible? Technically yes, if you have some reliable infomation somewhere, like older version of the game, otherwise, no.
Since I've never released an unobfuscated apk, I was starting to relax regarding the need to obfuscate IL2CPP in the first place.

Until I saw this video:

about a product made to decompile Unity IL2CPP into readable script. It was made by this lot: http://devxdevelopment.com/

How is this possible? Put another way why would Unity make it so easy to decompile their IL2CPP?

Would using one of the Asset Store obfuscators help prevent the near-perfect decompilation that devxdevelopment claims they can do?

 

Unity does not make it easy or hard. They just use the same tech as anyone else when it comes to compiling C++ code. It‘s really not that difficult to decompile ANY compiled binary into readable source code. It may not be the original code and the identifiers may be generated, but the logic is easily extracted from compiled code. After all, in the end we are talking machine code here which has to preserve the intended logic provided by the programmer, right? And machine code in itself can be translated back to higher level language code that is human readable. No magic here, none.

Anyhow … do you have an actual issue with hackers? Is your game successful enough or would it getting hacked cost you real money (because let‘s say server traffic increases hundredfold)? If not it‘s simply not worth concerning yourself with that.

 

Why exactly are you squandering your life on this Sisyphean task?

To protect your game? Protect?! Against who, Ze Germans?!

If you're concerned about the user 'hacking your save files,' or 'cheating in your game,' which is playing on their computer, just don't be.

There's nothing you can do about it. Nothing is secure, it is not your computer, it is the user's computer.

If it must be secure, store it on your own server and have the user connect to download it.

Anything else is a waste of your time and the only person you're going to inconvenience is yourself when you're debugging the game and you have savegame errors. Work on your game instead.

Remember, it only takes one 12-year-old in Finland to write a script to read/write your game files and everybody else can now use that script. Read about Cheat Engine to see more ways you cannot possibly control this.

 

The only reason I'm worried about the Germans is they want us all to eat Ze Bugs, and take Ze 'Safe and Effective' experimental gene-therapies to protect (except in reality the 'vaccinated' are more likely to catch it) against a cold. After all, who wouldn't rather have a stroke/heart attack/turbo cancer/bells palsy etc. etc. etc?

Back on track - no I don't care about cheating or hacking save files. I do care about someone able to easily decompile the binary into readable source. I want them to work for it, as I've worked for 2+ years making the damn thing. So yeah, a matter of principle as much as anything. I also realise that in all probability, no one is even going to bother for some crappy game.

To finish, you call this a Sisyphean task. The Obfuscators in the Unity Store claim it is a few button presses and done, and at least one of them has an app that can decompile stack traces for debugging. But I think IL2CPP makes much of their obfuscation redundant, such as renaming.

 

Pretty much, if the obfuscation is only on the C# level.

Then again, any code obfuscation comes with tradeoffs. One being that you really really really really have to trust the tool to not confabulate your code in some way that it actually produces bugs, crashes and what not. The other being that it may affect runtime performance - obfuscated code may sometimes need to do more than clean code - if it includes rewriting the code. Which a good obfuscator should probably do - inserting fake function calls and such to open time-consuming rabbit holes and honeypots for hackers without making them easily recognizable.

And lastly, the obfuscation needs to be effective and I would want to see proof of that. Like proof that it fails to produce readable output from common decompilers, or hackers competing on decoding an obfuscated app and how much time it takes them (it is only a matter of time, really) vs unobfuscated versions. Expert opinions really. Which are hard to come by.

Some of the things these obfuscators advertise in doing are really of no concern to the hackers who go about the other way, taking the machine code and regenerating high-level language source code from that.

 

You are correct (sorry Unity). I had misunderstood the devxdevelopment product - it needs the Unity editor files to work. It now makes sense, I was confused as to how they could get back original names from c++.
As to my motivations for (maybe) doing this, I tried to answer in the reply to Kurt Dekker.

 

Thanks for the summary. I agree that rabbit holes and honeypots are great for confusing the hacker, but share your concern as to performance/stability issues that may come with.
Still, the hackers/modders on this thread seem pretty baffled as to how to deobfuscate IL2CPP code if it had been obfuscated.
https://platinmods.com/threads/is-it-possible-to-deobfuscate-il2cpp-game.122359/

 

Well, let me just say it seems like you're full of vigor and energy and feisty about game development, so all I am saying is you should probably elect to channel your wonderful energy into making your game better and bigger and wowier and more amazing...

I assure you after a year of intense gamedev you will realize how some user decompiling a game they love isn't going to sink your battleship.

Have fun man...

 

I used to be concerned about this sort of thing until I learned, as Kurt pointed out, that you can't truly secure anything that is no longer in your vault. One of the games I helped ship (supposedly) had bootleg copies available for free on Google searches the day after launch. It was probably automated somehow. Only a server can make you secure because you attempt to control what goes on behind the walls of your server. But, most customers are honest and they just want to go through the proper channels if possible. Also, as CodeSmile pointed out, it would undoubtedly affect performance. I could have tried to obfuscate the dlls on my latest project. However, I would have been wasting my time to make my code run slower. The copyrights are automatically in place. So, that's about the best you can do.