Obfuscation in Unity — How to Protect Games & Apps from Hackers and Reverse Engineering
For Many Unity Developers, Obfuscation is Another Layer of Basic Software Protection rather than a Complete Security Solution. However, the Goal of this Layer is to Make Reverse Engineering Significantly More Difficult, Expensive, and Time-Consuming. Learn More about Unity Obfuscation and How to Protect your Games and Apps in this Tutorial.
Note: This post is sponsored by Tim Uhlott, Founder of GuardingPearSoftware and Obfuscator Pro.
What is Obfuscation?
Code Obfuscation Transforms Compiled Code so that it Becomes Significantly Harder for Humans to Understand While Preserving the Application’s Functionality.
// For Example, an Obfuscator Can Rename Classes,
// Methods, Fields, Other Identifiers from this:
health.TakeDamage();
// to this:
a.b();
The Underlying Logic still Performs the Same Operation, but the Names and Structure Provide Much Less Useful Context to Someone Analyzing the Application.
Obfuscation Can also Include Techniques Such as:
- Identifier Renaming
- String Encryption
- Control-Flow Obfuscation
- Metadata Encryption
- Anti-Tampering Mechanisms
- Code Signing
- Watermarking
- Runtime Protection
- Virtualization
The Exact Techniques Available Depend on the Obfuscation Solution and the Type of Unity Build Being Protected.
Why Use Obfuscation in Unity?
Your Game May Contain Years of Development Work, Custom Algorithms, Gameplay Systems, Monetization Logic, or Other Intellectual Property. Without Protection, a Reverse Engineer may be Able to Quickly Identify What Different Parts of the Application Do.
Obfuscation Plugins (e.g., Obfuscator Pro) Remove much of the Human-Readable Context. It is Not a Replacement for Copyright, Licensing, or Legal Protection, but It Can Provide a Technical Barrier Against Unauthorized Analysis.
An Attacker (or Hacker) Does Not Necessarily Need to Understand Your Entire Game. They May Only Need to Find a Specific Piece of Code Responsible for Critical Functionality and Exploit It to Cause Harm:
- Licensing
- In-App Purchases
- Authentication
- API Access
- Premium Features
- Anti-Cheat Functionality
- Game Logic
- DRM
- Network Communication
- Content Protection
Readable Class and Method Names Can Make this Process Considerably Easier. Good Obfuscation Removes Much of That Useful Context. Instead of Immediately Seeing Something Like the code below.
LicenseManager.ValidateLicense()
An Analyst May Encounter Meaningless Names and Additional Transformations that Make Understanding the Original Code Substantially Harder. This Does Not Make the Code Impossible to Analyze. It Increases the Amount of Work Required.
Before Enabling Aggressive Protection, Consider How Much Protection You Actually Need (all of these quiestion are explaned in this tutorial):
- What Are You Protecting?
- Who is the Likely Attacker?
- How Valuable is the Protected Code?
- How Much Additional Complexity Can Your Project Tolerate?
- What Performance Overhead Does Each Technique Introduce?
- Does Your Game Support Modding?
- Which Platforms Are You Targeting?
Obfuscation is About Increasing the Cost of an Attack
Protecting a Unity Game or Application from Reverse Engineering, Unauthorized Modification, Piracy, and Code Theft can be Challenging. If Someone has Enough Time and Motivation, No Client-Side Protection Can Make Software Completely Impossible to Analyze.
It is Important Not to Treat Obfuscation as a Magic Solution. A Determined Attacker Can Potentially Analyze Any Software that Runs on a Device They Control.
A Useful Way to Think About Software Protection is Effort Versus Reward. A Potential Attacker will often Weigh the Effort Required to Break a Protection Mechanism Against the Value of the Target. If Analyzing or Modifying a Game Takes Hours, Days, or Weeks Instead of Minutes, Some Attackers May Simply Move On to Another Target.
This is Particularly Relevant for Games and Applications that are Distributed to End Users, Because the Client-Side Code Ultimately Has to Run on a User’s Device. There is No Perfect Way to Hide Everything that Must Eventually Execute on the Client. Instead, Developers Can Use Multiple Layers of Protection to Increase the Difficulty of Analyzing and Modifying the Software.
Does Obfuscation Affect Unity Performance?
One Criticism of Obfuscation is that It Can Introduce Runtime Overhead. This Can Be True for Some Techniques, but Not Every Obfuscation Technique Has the Same Performance Impact.
For Example, Identifier Renaming Generally Changes Names Rather Than the Underlying Operations Performed by the Application. Renaming Can Even Reduce the Size of Some Metadata Because Long Identifiers are Replaced with Shorter Ones.
String Protection can also be Implemented in Different Ways. Depending on the Implementation, Strings May Be Decrypted When They Are Needed or Loaded (for example, with a New Game Level), rather than Repeatedly Performing Expensive Operations Every Time They are Accessed.
Control-Flow Obfuscation
Control-Flow Obfuscation is Different. It Modifies the Structure of Program Execution to Make the Logic Harder to Follow. Additional Branches, Jumps, or Transformations Can Introduce some Runtime Overhead.
Feedback from More than 4,000 Studios using Obfuscation Tools Suggests that the Performance Impact of Control-Flow Obfuscation is Typically around 1%.
Tim Uhlott, Creator of Obfuscator Pro
The Actual Impact Will Depend on the Implementation, Target Platform, and the Code Being Protected, so Developers Should Benchmark their Own Builds rather than Assume a Universal Number. For Most Projects, It May Be Possible to Combine Several Protection Techniques While Keeping Performance Overhead Small.
A Useful Comparison is Website Security. For Example, External Services Such as Cloudflare Can Introduce Some Latency while Providing Protection Such as DDoS Mitigation and a Web Application Firewall — much like a speed limit on the road. However, Hosting-Side Real-Time Malware Protection that can run natively (rather than within your website’s PHP code) doesn’t delay your website’s Time to First Byte (TTFB).
The Same Principle Can Apply to Game Protection. Developers Can Choose Which Parts of Their Code Require Stronger Protection and Which Parts Do Not. Not Every Class or Method Necessarily Needs the Same Level of Obfuscation.
For Example, Performance-Sensitive Code Can Be Treated Differently From Sensitive Licensing or Authentication Logic. The Goal is to Find an Appropriate Balance Between:
Security → Performance → Development Complexity.
Obfuscation and Video Game Modding
Obfuscation is Not Necessarily Appropriate for Every Game. If You Actively Want Players or Developers to Modify Your Game, Heavily Protecting the Code Can Make That Process More Difficult.
Modding Communities often Depend on Understanding or Interacting With the Game’s Code. Minecraft is an Interesting Example. Its Code Has Historically Been Obfuscated, Yet a Large Modding Ecosystem Has Developed Around It.
Obfuscation Makes Code Harder to Understand, but it Does Not Automatically Make Modification Impossible.
If Your Project Depends on Unofficial Modding or You Want Your Community to Inspect and Extend the Code, You Should Carefully Consider Whether Obfuscation is Appropriate.
On the Other Hand, if Protecting Intellectual Property and Making Unauthorized Code Analysis More Difficult are Important Goals, Obfuscation Can Be Useful.
Is Obfuscation Useful on Console Platforms?
Console Platforms (Xbox or PlayStation) Generally Provide Stronger Platform-Level Security than Typical PC or Android Environments. That Does Not Mean Obfuscation is Useless. It Can Still Help Reduce the Readability of Application Code and Hide Context that Could Be Useful During Analysis.
Code Protection Can Still Be Part of a Broader Security Strategy, Particularly When a Game Contains:
- Licensing Systems
- API Integrations
- Authentication Logic
- Proprietary Algorithms
- Sensitive Game Logic
Obfuscation for Android and PC platforms
Android and PC Applications are Generally More Accessible to Users and Researchers than Software Running Inside Tightly Controlled Console Ecosystems like iOS, macOS, Linux, Consoles, etc.
For Developers Distributing Unity Applications on These Platforms, Reverse Engineering and Unauthorized Modification Can Therefore Be a More Practical Concern. This is Especially Relevant to Mobile Games and Applications Distributed through Channels where Modified or Cracked Versions Can Be Redistributed.
Obfuscation Cannot Prevent Someone from Copying an Application, but It Can Make Understanding and Modifying Its Code More Difficult in Terms of Attack Cost.
Additional Levels of Security
Sensitive Decisions Should Ideally Not Depend Exclusively on Code Running on an Untrusted Client App. In Addition to obfuscation, you can consider another level of security, for example:
- Server-Side Validation (e.g., for IAPs and Subscriptions because when a Game Relies Entirely on the Client to Determine whether a Purchase is Valid, Protecting That Client-Side Code Does Not Provide the Same Level of Security as Validating the Transaction on a Server)
- Authentication
- Secure API Design
- Code Signing
- Anti-Tampering
- Integrity Checks
- Licensing Systems
- Watermarking
- String, Runtime, and Metadata Protection
- Server-Authoritative Game Logic
- Monitoring for Unauthorized Versions
What is Code Virtualization?
More Advanced Protection Can Go Beyond Traditional Obfuscation. Code Virtualization Transforms Selected Code Into a Custom Instruction Set that is Executed by a Virtual Machine Embedded Inside the Application.
Instead of Directly Exposing the Original Program Instructions, the Protected Code is Converted Into Instructions Understood by the Application’s Custom Virtual Machine. Work Scheme (Stages) is below:
- Original C# Code
- Virtualization
- Custom Instruction Set
- Embedded Virtual Machine
- Runtime Execution
This Can Make Reverse Engineering Considerably More Complicated Because the Analyst is No Longer Dealing Only With the Original Compiled Code Structure.
The Developer of Obfuscator Pro is also Working on Sentinel, a Tool Intended to Help Game Developers Identify Unauthorized Copies of Their Games, including Cracked Versions and Reskins Distributed Across the Web.
This Addresses a Different Part of the Problem. While Obfuscation Primarily Focuses on Making Software Harder to Analyze and Modify, Monitoring Focuses on Detecting Unauthorized Copies After They Appear. Together, These Approaches Represent Two Different Layers of Software Protection:
- Protect the Code
- Detect Unauthorized Distribution
This Distinction is Particularly Relevant for Android and PC Games and Applications, where Unauthorized Copies and Modified Versions Can Become Widely Distributed.
Unity Hacker
I was blocked by a Unity Developer who was bragging about creating a Tool that can Hack Apps/Games and claiming that Obfuscation is NOT a Big Barrier. I said that this could potentially be illegal.
However, Good Obfuscation can Slow Bad Guys Down for Weeks or Even Months when it comes to Reverse Engineering, considering 24/7 work.
Obfuscator Pro — Unity Asset
Obfuscator Pro is an Asset for the Unity Game Engine that Designed to Protect Unity Games and Applications against Reverse Engineering, Unauthorized Modification, and Code Theft. It Combines Multiple Protection Techniques, and Some of These Techniques Are Designed Specifically to Protect Code Without Introducing Significant Performance Overhead.
