Unity 3D Obfuscator - a special protection tool for Unity 3D

Unity 3D Obfuscator - a special protection tool for Unity 3D applications.

http://en.unity3d.netobf.com/
http://en.unity3d.netobf.com/Unity3dObfuscatorSetup.exe
http://en.unity3d.netobf.com/Unity3dObfuscatorSetup.zip

Product features:

- Entity Renaming:
Renaming scripts, classes, methods, fields into a set of meaningless or unreadable characters;
Supporting obfuscation control attributes (System.Reflection.ObfuscationAttribute)

- Removing events and properties:
This method comes down to removing the metadata of events and properties from the assembly, which makes it impossible to recover or use these properties from high-level languages (C#, Boo, ...).

- Renaming methods, variables, etc. into a set of unreadable characters:
It comes down to replacing names with unreadable characters, for example, Japanese characters. Though .Net works with the UTF8 encoding, not all decompilers correctly process its characters. Some change names with such characters for more understandable, some replace unreadable characters with their codes, some just refuse to work with such characters.

- Obfuscating the control flow graph:
Obfuscating conditional branches:
This method comes down to adding various false conditions to the algorithm body and scattering the checks of existing conditions, loops and unconditional branches over the function body.

- Protection against decompilers:
Protection against decompilers considerably reduces the chances to recover the source code of an application in an assembly or high-level language (C#, VB, etc.).

- Obfuscation of Standalone Assemblies

Support:
- Web Player
- Web Player Streamed
- OS X Dashboard Widget
- Windows Standalone
- OS X Universal Binary Standalone
- OS X PPS Standalone
- OS X Intel Standalone

- Some of the functions free

Learn more about the features...
http://en.unity3d.netobf.com/unity3dobfuscator

 

Sample protect use "Unity 3D Ofuscator"
Images:
1 - After protect
2 - After protect
3 - Before protect

 

Windows only, eh? Bummers.

 

The utility runs on Windows,
and is designed to protect the following types of projects:
Web Player
Web Player Streamed
Windows Standelone

 

The assembly output by this utility should still work on osX.

If you want something that would run on osX as well, there are a few open source obfuscation projects that are built on top of Mono's Cecil library.

http://sharpobfuscator.codeplex.com/

http://code.google.com/p/obfuscar/

 

The new version obfuscator "Unity3dObfuscator" v 1.2.07


Changes compared to version 1.2.06:

- Support OS X Dashboard Widget
- Support OS X Universal Binary Standalone
- Support OS X PPS Standalone
- Support OS X Intel Standalone

http://en.unity3d.netobf.com/download

 

Sample: Unpacking and decompilation - .unity3d file (for not protected files):

http://en.unity3d.netobf.com/unity3d_decompiler

In:
3dperson.unity

Out:
Assembly - CSharp.dll
Assembly - UnityScript.dll
mainData
sharedassets0.assets

And decompilation with reflector...

 

I tried this with a test standalone windows build project.

1. It failed to detect assemblies, unless I moved the .exe into the data folder - which sort of does not make sense.
2. The exe crashed after it was obfuscated.

Would love to see if this works but has a couple of showstoppers for me so far.

 

i just tried this on a webplayer and it wrecked the game > the game does not work now

anyone know of an obfuscator that works ?

** edit *** i think i know why my game wont work now ... to start with, the editor was complaining about my mouse look before i obfuscated the game... so it is my bad.. this thing does work !!!! i just forgot that my mouse look script was crapped ..im gonna fix my mouse look on my game and then obfuscate it again and see if it works ... the game was working with the mouse look editor error though before ...but now that i obfuscated it, it got fixed and the result was no mouse look now ..so back i go and fix my mouse look...

 

okay, i just fixed my game with a working mouse look and the game had no errors at all after and before building a webplayer.. now after i built the webplayer and obfuscated it using this program that sells for $150 it does not work ... my game does not work now and i think this program is a piece of sh******t and i have wasted a good 4 hours on this crap.. i dont recommend using this program anyone

if you want to see the result of what it did to my game, just click on my site and try it out .. its just that the game has no control now but i will fix it later but not with this piece of sh*******t program

edit*** i fixed my game and now it finally works... i dont recommend using this program anyone

 

nildar: How does it work for e.g.:

Does't it mess up this functionality?

 

Tried to purchase obfuscator from the asset store. Instead of downloading importing the obfuscator package, I was prompted to d/l the JS to C package instead. I would like to either request a refund or receive the obfuscator package.
thanks,

 

droderick: Thats not the obfuscator from this topic, but one I made based on obfuscar. I have been aware of that issue but the asset store team is so busy they still haven't been able to fix it. I first contacted them about this weeks ago. I am unable to fix this myself, there are no tools to quickly update/remove a package or to see who and how often the package was bought.

Feel free to keep the JS to C package for free, I'm sure the asset store team fixes this soon enough now so that you'll be able to receive the bought Obfuscator package. Plus I've send you a PM.

EDIT Problems resolved, please update the package .

 

Hi,

Does it work with methods invoked by reflection? Like:

Messenger.AddListener(EVENT_X, "OnEventX");

...

public void OnEventX()
{
}

 

The new version obfuscator "Unity3dObfuscator" v 1.3.05

Changes compared to version 1.2.07:

- Support Unity 3.3 version
- Added a new functional insert a time-limit of the protected products
- Protection from unpack unity3d file.

http://en.unity3d.netobf.com/download

 

The new version obfuscator "Unity3dObfuscator" v 1.3.08

Changes compared to version 1.3.05:

- Fiexed bugs
- Fixed: limit in the demo version when you use pay-functional
- Fixed: a functional insert a time-limit of the protected products

http://en.unity3d.netobf.com/download

 

It's not encouraging that nildar isn't responding to Ullukai's problems.
Also, the Unity 3d Obfuscator web site has no instructions. I downloaded the trial and can't figure out how to use it. I made a build and opened it in the obfuscator which made a file called WebPlayer.inqprj that's under 2k and I don't know what to do with it.

Does anyone know how to use this program? Has anyone had good results with it?
Does anyone know other products that might work better?

(Leepo, I love your networking package, but your obfuscator in the asset store just doesn't change enough. It doesn't change function names, class names, or even all of the variable names and just doesn't seem to do very much, sorry. An obfuscator should make the code harder to read.)

 

I think you're a pig, nildar and I fart in your general direction.

You don't respond to anyone. I think it is enormously disrespectful and I advise people that there is no smoke without fire.

Pretty sure he's not an english speaker. As he is here only to try and rob you.

 

Ha! Where's the "Like" button on this thing?!

 

There are dozens of free obfuscators if you look about with google. The popular one seems to be eazfuscator.

http://www.foss.kharkov.ua/g1/projects/eazfuscator/dotnet/Default.aspx

However the more popular the package the greater the chance that someone has written a deobfuscator for it. Find one that's relatively unknown, yet still works for your purposes.

 

Quietus,
That looks like a good product. I am an intermediate level programmer so this is a new area to me. The instruction image looks like I should drag and drop my Visual C# Project File from my Unity Project folder into the obfuscator. I did that and it said "Protected project will be obfuscated automatically during the build in Release configuration" so I'm done?

Also, I noticed that the C# solution folder gets created when I use MonoDevelop to modify a script. Is there anything special I need to do besides modify a single script with MonoDevelop then drag and drop the Visual C# Project File into the obfuscator?

Thanks this could be 'good enough' for what I'm doing!

 

Video help


Description


Unity3D Web Player Obfuscation:

Unity3D Windows Standalone Obfuscation:

 

I haven't used that product before, but I would personally look for something that works directly on an assembly and not the project itself. They're probably just using the project for it's meta data/symbol tables, but it still makes me feel uncomfortable. I gave you that as it's just one I've seen often referenced.

If you go find that old 10 page 'hacking' thread, there are a handful of obfuscators mentioned towards the end of the thread which people have had success using with Unity. A quick google search will also uncover oodles of free obfuscators, as well as complete tutorials on how to go about writing your own. It seems to be a popular project for univ com-sci students.

 

Lesson 1 - Unity3D Windows Standalone - obfuscation
1. View disassemble code before obfuscation
2. Obfuscation
3. View disassemble code after obfuscation

 

Unity3D Obfuscator
- Unpack .unity3d file
- Import unpacked resources with Unity
- Obfuscate (protect) .unity3d file

 

Greetings,

I downloaded the demo of Unity3D Obfuscator 1.3.08 from the site. I tried to Obfuscate a webplayer's unity3d file using the tool. Thereafter I tried to browse the assembly using Red Gate's .NET Reflector. I've attached an image of what I see with Reflector. The Obfuscator seems to have produced a couple of phantom entries for each of the assembly member methods ( marked as 2) . The original entry is (marked as 1) is visible for inspection. Unity3D Obfuscator seems to have added a comment and a goto statement, this hasn't stopped reflector from showing the actual code :-|

Not sure this is reliable enough to use.


Version information:
Unity3D Pro 3.3.0f4 (63135)
Unity3D Obfuscator 1.3.08
Red Gate .Net Reflector 7.1.0.143

Will try out the other obfuscators , cheers Quietus for the suggesting the alternatives.

Cheers!

[EDIT]
Looking at various threads on Unity3D forums about obfuscation and other such IP protection methodologies it seems like a lost cause to think about it. The general agreement it seems is that each commercial obfuscator has (can have) a deobfuscator. The best way to make it difficult for the average script kiddie, it appears , is perhaps to employ a .NET intern and write some code ourselves. It'll perhaps raise the bar a bit, but obviously not prevent the problem.

Regards

 

Nildar,

/ranton

If you are serious about developing this product you need to engage with developers, accept their feedback and make sure the damn thing works 100% of the time - esp for the price you are charging.

I just tested this again, after a break, AND IT DOES NOT WORK RELIABLY.
I tried a test in free mode, decompiled it with reflector and saw mild renaming as per the free limits.

The obfuscated webplayer worked.

I then tried a partial obfuscation using "licensed mode" (which when unlicensed restricts usage to the day of processing it) with ONLY object names renaming checked (and cannot test classes/functions renaming as they are greyed out) AND THE WEBPLAYER FAILS TO WORK.

Just a blank screen.

The potential of this product, if it works reliably is huge.
I just don't understand why you do not respond to developers who test it and it obviously fails to work.

Do you want to sell licenses for it or not? Then accept the bug reports and fix the damn thing. I'd buy it in a heartbeat if I could really test it and trust it. At the moment...NO;-(

/rant off

Cheers,
sv

 

Nildar doesn't care. The people behind this product do not care.


Please post here when you find a product / team that does work / care so that I'll get a notification.

Aloha!

 

Do not buy this product. The word "scam" came to mind.

 

ditto

 

Just use Eazfuscator, its free... Who doesn't know how to get it working with Unity shouldn't use obfuscation anyway ... Especially for IP protection I would never use such unknown products made by unknown people. Either Open Source or from an established company...

 

Sorry I don't understand but can I obfuscate my game for Android and iPhone with this tool?

 

We have a paid version of Unity 3D Obfuscator to be able to automate the obfuscation process.
However for the webplayer I cannot get the command line obfuscation to work with the right settings disabled.

Using this syntax the /EnableRemoveEventsAndProperties=0 parameter does not appear to have any effect:
InqObfuscatorUnity.exe /build /Rename=1 /DontRenameClass=0 /IsDontRenamePublic=1
/EnableRemoveEventsAndProperties=0
/EnableProtectionFromDecompilers=1 "c:\unity_test.unity3d"

It is also does not appear to be possible to save a project file for webplayer project (it does work for exe files).

Could someone give me a pointer on how to disable the events and properties obfuscation form command line?

Or fix the obfuscator so that the commandline parameter actually works of that we can save a webplayer project file.

 

It's very pricey for indies

 

The webplayer obfsucation with builds from Unity 3.x very fine, but now with Unity 4 it does not work anymore.

 

doing work only on Windows OS

can you please provide for MAC

 

does this still work? with 4.5?

 

I can't install the Unity3D Obfuscator. I downloaded the setup and rar file and it keeps telling me the files are corrupt or damaged. PLEASE HELP!!!

 

why is unity3d.com not developing this kind of tools ?
its codesave (to unityeditor) and i think more secure in things like backdoors trojaners usw

 

Because the whole concept is hogwash and always has been. I'm an IT Security expert in real life and I've always advised people against obfuscators. I know the attacker perspective, and obfuscators may confuse newbies, but that's it. Anyone seriously intending to steal your game will get a de-obfuscator or write one himself. Since the process is reversible, the only information you really destroy is the meaning of variable and function names, which does make it more difficult to interpret the code, but it's no worse than reading code from someone speaking another language.

On the other hand, you lose 90% of your ability to fix bugs in the field. If you can't reproduce the bug on a development system, you're F***ed.

I don't get why you think an obfuscator would do anything for security at all. I'd rather say the opposite, it makes it easier to inject code.

 

that is a statement
in one line : Who wants, can do!

other question : is there a way to protect the c# code from my projekt in e.g. Webplayer projekt ( *.unity3d ) file
against rippers ( C&P guys ) who share or use it on own projects ?

 

Just curious: how does it make it easier to inject? I mean isn't it by default as easy as calling couple of windows.h methods (on Win at least) ? Did some injection for API instrumenting some time ago and from what I remember the injection part was just a few lines of code to iterate through processes and identify the one I was after and then one or two WinAPI calls to inject my DLL.

 

Not technically, but conceptually. For a straight build, it's fairly easy to validate that the binary is indeed your compiled code. Any additional tool you add to the toolchain adds complexity that makes such validation more difficult.

 

This product seems to be discontinuated. It's any other new solution? I tried CODEGUARD from the asset store and it didn't worked for me. I also didn't received support from the author.

 

This product has had zero support from the beginning so I'm locking this with strong advice to not purchase it.

PS. Obfuscation is pointless. It offers zero security benefit.