Search Unity

  1. Unity 2019.2 is now released.
    Dismiss Notice

Unity 3D Obfuscator - a special protection tool for Unity 3D

Discussion in 'External Tools' started by nildar, Jun 12, 2010.

Thread Status:
Not open for further replies.
  1. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    Unity 3D Obfuscator - a special protection tool for Unity 3D applications.

    http://en.unity3d.netobf.com/
    http://en.unity3d.netobf.com/Unity3dObfuscatorSetup.exe
    http://en.unity3d.netobf.com/Unity3dObfuscatorSetup.zip

    Product features:

    - Entity Renaming:
    Renaming scripts, classes, methods, fields into a set of meaningless or unreadable characters;
    Supporting obfuscation control attributes (System.Reflection.ObfuscationAttribute)

    - Removing events and properties:
    This method comes down to removing the metadata of events and properties from the assembly, which makes it impossible to recover or use these properties from high-level languages (C#, Boo, ...).

    - Renaming methods, variables, etc. into a set of unreadable characters:
    It comes down to replacing names with unreadable characters, for example, Japanese characters. Though .Net works with the UTF8 encoding, not all decompilers correctly process its characters. Some change names with such characters for more understandable, some replace unreadable characters with their codes, some just refuse to work with such characters.

    - Obfuscating the control flow graph:
    Obfuscating conditional branches:
    This method comes down to adding various false conditions to the algorithm body and scattering the checks of existing conditions, loops and unconditional branches over the function body.

    - Protection against decompilers:
    Protection against decompilers considerably reduces the chances to recover the source code of an application in an assembly or high-level language (C#, VB, etc.).

    - Obfuscation of Standalone Assemblies

    Support:
    - Web Player
    - Web Player Streamed
    - OS X Dashboard Widget
    - Windows Standalone
    - OS X Universal Binary Standalone
    - OS X PPS Standalone
    - OS X Intel Standalone

    - Some of the functions free

    Learn more about the features...
    http://en.unity3d.netobf.com/unity3dobfuscator
     

    Attached Files:

    rakkarage likes this.
  2. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    Sample protect use "Unity 3D Ofuscator"
    Images:
    1 - After protect
    2 - After protect
    3 - Before protect
     

    Attached Files:

  3. bigkahuna

    bigkahuna

    Joined:
    Apr 30, 2006
    Posts:
    5,435
    Windows only, eh? Bummers.
     
  4. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    The utility runs on Windows,
    and is designed to protect the following types of projects:
    Web Player
    Web Player Streamed
    Windows Standelone
     

    Attached Files:

  5. Quietus2

    Quietus2

    Joined:
    Mar 28, 2008
    Posts:
    2,060
  6. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    The new version obfuscator "Unity3dObfuscator" v 1.2.07


    Changes compared to version 1.2.06:

    - Support OS X Dashboard Widget
    - Support OS X Universal Binary Standalone
    - Support OS X PPS Standalone
    - Support OS X Intel Standalone

    http://en.unity3d.netobf.com/download
     

    Attached Files:

  7. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    Sample: Unpacking and decompilation - .unity3d file (for not protected files):

    http://en.unity3d.netobf.com/unity3d_decompiler

    In:
    3dperson.unity

    Out:
    Assembly - CSharp.dll
    Assembly - UnityScript.dll
    mainData
    sharedassets0.assets

    And decompilation with reflector...
     
  8. sonicviz

    sonicviz

    Joined:
    May 19, 2009
    Posts:
    1,016
    I tried this with a test standalone windows build project.

    1. It failed to detect assemblies, unless I moved the .exe into the data folder - which sort of does not make sense.
    2. The exe crashed after it was obfuscated.

    Would love to see if this works but has a couple of showstoppers for me so far.
     
  9. Ullukai

    Ullukai

    Joined:
    Aug 24, 2010
    Posts:
    737
    i just tried this on a webplayer and it wrecked the game > the game does not work now :(

    anyone know of an obfuscator that works ?

    ** edit *** i think i know why my game wont work now ... to start with, the editor was complaining about my mouse look before i obfuscated the game... so it is my bad.. this thing does work !!!! i just forgot that my mouse look script was crapped ..im gonna fix my mouse look on my game and then obfuscate it again and see if it works ... the game was working with the mouse look editor error though before ...but now that i obfuscated it, it got fixed and the result was no mouse look now ..so back i go and fix my mouse look...
     
    Last edited: Oct 29, 2010
  10. Ullukai

    Ullukai

    Joined:
    Aug 24, 2010
    Posts:
    737
    okay, i just fixed my game with a working mouse look and the game had no errors at all after and before building a webplayer.. now after i built the webplayer and obfuscated it using this program that sells for $150 it does not work ... my game does not work now and i think this program is a piece of sh******t and i have wasted a good 4 hours on this crap.. i dont recommend using this program anyone

    if you want to see the result of what it did to my game, just click on my site and try it out .. its just that the game has no control now :( but i will fix it later but not with this piece of sh*******t program

    edit*** i fixed my game and now it finally works... i dont recommend using this program anyone
     
    Last edited: Nov 21, 2010
  11. MikeHergaarden

    MikeHergaarden

    Joined:
    Mar 9, 2008
    Posts:
    980
    nildar: How does it work for e.g.:

    Does't it mess up this functionality?
     
  12. droderick

    droderick

    Joined:
    Aug 25, 2008
    Posts:
    169
    Tried to purchase obfuscator from the asset store. Instead of downloading importing the obfuscator package, I was prompted to d/l the JS to C package instead. I would like to either request a refund or receive the obfuscator package.
    thanks,
     
  13. MikeHergaarden

    MikeHergaarden

    Joined:
    Mar 9, 2008
    Posts:
    980
    droderick: Thats not the obfuscator from this topic, but one I made based on obfuscar. I have been aware of that issue but the asset store team is so busy they still haven't been able to fix it. I first contacted them about this weeks ago. I am unable to fix this myself, there are no tools to quickly update/remove a package or to see who and how often the package was bought.

    Feel free to keep the JS to C package for free, I'm sure the asset store team fixes this soon enough now so that you'll be able to receive the bought Obfuscator package. Plus I've send you a PM.

    EDIT Problems resolved, please update the package :).
     
    Last edited: Jan 20, 2011
  14. Inovora

    Inovora

    Joined:
    Oct 29, 2009
    Posts:
    33
    Hi,

    Does it work with methods invoked by reflection? Like:

    Messenger.AddListener(EVENT_X, "OnEventX");

    ...

    public void OnEventX()
    {
    }
     
  15. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    The new version obfuscator "Unity3dObfuscator" v 1.3.05

    Changes compared to version 1.2.07:

    - Support Unity 3.3 version
    - Added a new functional insert a time-limit of the protected products
    - Protection from unpack unity3d file.

    http://en.unity3d.netobf.com/download
     

    Attached Files:

  16. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    The new version obfuscator "Unity3dObfuscator" v 1.3.08

    Changes compared to version 1.3.05:

    - Fiexed bugs
    - Fixed: limit in the demo version when you use pay-functional
    - Fixed: a functional insert a time-limit of the protected products

    http://en.unity3d.netobf.com/download
     
  17. Vimalakirti

    Vimalakirti

    Joined:
    Oct 12, 2009
    Posts:
    755
    It's not encouraging that nildar isn't responding to Ullukai's problems.
    Also, the Unity 3d Obfuscator web site has no instructions. I downloaded the trial and can't figure out how to use it. I made a build and opened it in the obfuscator which made a file called WebPlayer.inqprj that's under 2k and I don't know what to do with it.

    Does anyone know how to use this program? Has anyone had good results with it?
    Does anyone know other products that might work better?

    (Leepo, I love your networking package, but your obfuscator in the asset store just doesn't change enough. It doesn't change function names, class names, or even all of the variable names and just doesn't seem to do very much, sorry. An obfuscator should make the code harder to read.)
     
    dsh likes this.
  18. hippocoder

    hippocoder

    Digital Ape Moderator

    Joined:
    Apr 11, 2010
    Posts:
    25,574
    I think you're a pig, nildar and I fart in your general direction.

    You don't respond to anyone. I think it is enormously disrespectful and I advise people that there is no smoke without fire.

    Pretty sure he's not an english speaker. As he is here only to try and rob you.
     
    Last edited: May 10, 2011
    BudgieKnight and AM_1 like this.
  19. Vimalakirti

    Vimalakirti

    Joined:
    Oct 12, 2009
    Posts:
    755
    Ha! Where's the "Like" button on this thing?!
     
  20. Quietus2

    Quietus2

    Joined:
    Mar 28, 2008
    Posts:
    2,060
    There are dozens of free obfuscators if you look about with google. The popular one seems to be eazfuscator.

    http://www.foss.kharkov.ua/g1/projects/eazfuscator/dotnet/Default.aspx

    However the more popular the package the greater the chance that someone has written a deobfuscator for it. Find one that's relatively unknown, yet still works for your purposes.
     
  21. Vimalakirti

    Vimalakirti

    Joined:
    Oct 12, 2009
    Posts:
    755
    Quietus,
    That looks like a good product. I am an intermediate level programmer so this is a new area to me. The instruction image looks like I should drag and drop my Visual C# Project File from my Unity Project folder into the obfuscator. I did that and it said "Protected project will be obfuscated automatically during the build in Release configuration" so I'm done?

    Also, I noticed that the C# solution folder gets created when I use MonoDevelop to modify a script. Is there anything special I need to do besides modify a single script with MonoDevelop then drag and drop the Visual C# Project File into the obfuscator?

    Thanks this could be 'good enough' for what I'm doing!
     
  22. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
  23. Quietus2

    Quietus2

    Joined:
    Mar 28, 2008
    Posts:
    2,060
    I haven't used that product before, but I would personally look for something that works directly on an assembly and not the project itself. They're probably just using the project for it's meta data/symbol tables, but it still makes me feel uncomfortable. I gave you that as it's just one I've seen often referenced.

    If you go find that old 10 page 'hacking' thread, there are a handful of obfuscators mentioned towards the end of the thread which people have had success using with Unity. A quick google search will also uncover oodles of free obfuscators, as well as complete tutorials on how to go about writing your own. It seems to be a popular project for univ com-sci students.
     
  24. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    Lesson 1 - Unity3D Windows Standalone - obfuscation
    1. View disassemble code before obfuscation
    2. Obfuscation
    3. View disassemble code after obfuscation


     
  25. nildar

    nildar

    Joined:
    Jun 12, 2010
    Posts:
    11
    Unity3D Obfuscator
    - Unpack .unity3d file
    - Import unpacked resources with Unity
    - Obfuscate (protect) .unity3d file

     
  26. Dev.D1

    Dev.D1

    Joined:
    Dec 29, 2010
    Posts:
    99
    Greetings,

    I downloaded the demo of Unity3D Obfuscator 1.3.08 from the site. I tried to Obfuscate a webplayer's unity3d file using the tool. Thereafter I tried to browse the assembly using Red Gate's .NET Reflector. I've attached an image of what I see with Reflector. The Obfuscator seems to have produced a couple of phantom entries for each of the assembly member methods ( marked as 2) . The original entry is (marked as 1) is visible for inspection. Unity3D Obfuscator seems to have added a comment and a goto statement, this hasn't stopped reflector from showing the actual code :-|

    Not sure this is reliable enough to use.


    Version information:
    Unity3D Pro 3.3.0f4 (63135)
    Unity3D Obfuscator 1.3.08
    Red Gate .Net Reflector 7.1.0.143

    Will try out the other obfuscators , cheers Quietus for the suggesting the alternatives.

    Cheers!

    [EDIT]
    Looking at various threads on Unity3D forums about obfuscation and other such IP protection methodologies it seems like a lost cause to think about it. The general agreement it seems is that each commercial obfuscator has (can have) a deobfuscator. The best way to make it difficult for the average script kiddie, it appears , is perhaps to employ a .NET intern and write some code ourselves. It'll perhaps raise the bar a bit, but obviously not prevent the problem.

    Regards
     

    Attached Files:

    Last edited: Jun 7, 2011
  27. sonicviz

    sonicviz

    Joined:
    May 19, 2009
    Posts:
    1,016
    Nildar,

    /ranton

    If you are serious about developing this product you need to engage with developers, accept their feedback and make sure the damn thing works 100% of the time - esp for the price you are charging.

    I just tested this again, after a break, AND IT DOES NOT WORK RELIABLY.
    I tried a test in free mode, decompiled it with reflector and saw mild renaming as per the free limits.

    The obfuscated webplayer worked.

    I then tried a partial obfuscation using "licensed mode" (which when unlicensed restricts usage to the day of processing it) with ONLY object names renaming checked (and cannot test classes/functions renaming as they are greyed out) AND THE WEBPLAYER FAILS TO WORK.

    Just a blank screen.

    The potential of this product, if it works reliably is huge.
    I just don't understand why you do not respond to developers who test it and it obviously fails to work.

    Do you want to sell licenses for it or not? Then accept the bug reports and fix the damn thing. I'd buy it in a heartbeat if I could really test it and trust it. At the moment...NO;-(

    /rant off

    Cheers,
    sv
     
  28. Vimalakirti

    Vimalakirti

    Joined:
    Oct 12, 2009
    Posts:
    755
    Nildar doesn't care. The people behind this product do not care.


    Please post here when you find a product / team that does work / care so that I'll get a notification.

    Aloha!
     
  29. dacloo

    dacloo

    Joined:
    Jun 30, 2005
    Posts:
    469
    Do not buy this product. The word "scam" came to mind.
     
  30. Ullukai

    Ullukai

    Joined:
    Aug 24, 2010
    Posts:
    737
  31. MrBurns

    MrBurns

    Joined:
    Aug 16, 2011
    Posts:
    378
    Just use Eazfuscator, its free... Who doesn't know how to get it working with Unity shouldn't use obfuscation anyway ;)... Especially for IP protection I would never use such unknown products made by unknown people. Either Open Source or from an established company...
     
  32. xikky

    xikky

    Joined:
    Dec 11, 2012
    Posts:
    47
    Sorry I don't understand but can I obfuscate my game for Android and iPhone with this tool?
     
  33. jwestra

    jwestra

    Joined:
    Mar 26, 2013
    Posts:
    1
    We have a paid version of Unity 3D Obfuscator to be able to automate the obfuscation process.
    However for the webplayer I cannot get the command line obfuscation to work with the right settings disabled.

    Using this syntax the /EnableRemoveEventsAndProperties=0 parameter does not appear to have any effect:
    InqObfuscatorUnity.exe /build /Rename=1 /DontRenameClass=0 /IsDontRenamePublic=1
    /EnableRemoveEventsAndProperties=0
    /EnableProtectionFromDecompilers=1 "c:\unity_test.unity3d"

    It is also does not appear to be possible to save a project file for webplayer project (it does work for exe files).

    Could someone give me a pointer on how to disable the events and properties obfuscation form command line?

    Or fix the obfuscator so that the commandline parameter actually works of that we can save a webplayer project file.
     
  34. sonicviz

    sonicviz

    Joined:
    May 19, 2009
    Posts:
    1,016
  35. softrare

    softrare

    Joined:
    Jun 12, 2011
    Posts:
    429
    The webplayer obfsucation with builds from Unity 3.x very fine, but now with Unity 4 it does not work anymore.
     
  36. payalsharma9988

    payalsharma9988

    Joined:
    Oct 31, 2013
    Posts:
    25
    doing work only on Windows OS

    can you please provide for MAC
     
  37. shkar-noori

    shkar-noori

    Joined:
    Jun 10, 2013
    Posts:
    833
    does this still work? with 4.5?
     
  38. Fruit_Juice

    Fruit_Juice

    Joined:
    Jul 29, 2014
    Posts:
    1
    I can't install the Unity3D Obfuscator. I downloaded the setup and rar file and it keeps telling me the files are corrupt or damaged. PLEASE HELP!!!
     
  39. dsh

    dsh

    Joined:
    Feb 27, 2013
    Posts:
    6
    why is unity3d.com not developing this kind of tools ?
    its codesave (to unityeditor) and i think more secure in things like backdoors trojaners usw
     
  40. Tom163

    Tom163

    Joined:
    Nov 30, 2007
    Posts:
    1,039
    Because the whole concept is hogwash and always has been. I'm an IT Security expert in real life and I've always advised people against obfuscators. I know the attacker perspective, and obfuscators may confuse newbies, but that's it. Anyone seriously intending to steal your game will get a de-obfuscator or write one himself. Since the process is reversible, the only information you really destroy is the meaning of variable and function names, which does make it more difficult to interpret the code, but it's no worse than reading code from someone speaking another language.

    On the other hand, you lose 90% of your ability to fix bugs in the field. If you can't reproduce the bug on a development system, you're F***ed.

    I don't get why you think an obfuscator would do anything for security at all. I'd rather say the opposite, it makes it easier to inject code.
     
    dsh likes this.
  41. dsh

    dsh

    Joined:
    Feb 27, 2013
    Posts:
    6
    that is a statement :)
    in one line : Who wants, can do! :(

    other question : is there a way to protect the c# code from my projekt in e.g. Webplayer projekt ( *.unity3d ) file
    against rippers ( C&P guys ) who share or use it on own projects ? :eek:
     
  42. Pirs01

    Pirs01

    Joined:
    Sep 30, 2012
    Posts:
    389
    Just curious: how does it make it easier to inject? I mean isn't it by default as easy as calling couple of windows.h methods (on Win at least) ? Did some injection for API instrumenting some time ago and from what I remember the injection part was just a few lines of code to iterate through processes and identify the one I was after and then one or two WinAPI calls to inject my DLL.
     
    Last edited: Oct 22, 2014
    shaderop likes this.
  43. Tom163

    Tom163

    Joined:
    Nov 30, 2007
    Posts:
    1,039
    Not technically, but conceptually. For a straight build, it's fairly easy to validate that the binary is indeed your compiled code. Any additional tool you add to the toolchain adds complexity that makes such validation more difficult.
     
  44. DarkSlash

    DarkSlash

    Joined:
    Sep 30, 2011
    Posts:
    111
    This product seems to be discontinuated. It's any other new solution? I tried CODEGUARD from the asset store and it didn't worked for me. I also didn't received support from the author.
     
  45. hippocoder

    hippocoder

    Digital Ape Moderator

    Joined:
    Apr 11, 2010
    Posts:
    25,574
    This product has had zero support from the beginning so I'm locking this with strong advice to not purchase it.

    PS. Obfuscation is pointless. It offers zero security benefit.
     
Thread Status:
Not open for further replies.