Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make my game extremely hard to decompile. So I've come up with the idea of a program which will contain my game's code, coded in a custom language, and which will translate that code into Java code during runtime. (So it's kind of like a virtual machine is running on top of Java's virtual machine, or at least the way I see it.)

In order to modify my game's code, the hacker would have to learn my custom language and create their own custom decompiler which would take some time. At least how I figure.

Is there any name for this kind of approach? Has it been done before? Is there a flaw I'm not seeing?

Thank you!

share|improve this question
The most relevant term for this I could think of is source code obfuscation, but what you propose wouldn't work to your advantage. What would stop anyone from reverse-engineering your own decompiled output before it's fed to Java's JIT? – TildalWave Jul 27 '13 at 13:38
Custom byte code is quite common in obfuscators. – CodesInChaos Jul 27 '13 at 13:55
up vote 4 down vote accepted

Is there a flaw I'm not seeing?

You have to create your own custom language. You will not have access to tools such as IDE's and debuggers that makes writing code in that language easier. You have to write a translator to translate your custom language into Java bytecode. You will not have access to ready made libraries for a large set of features so you will have to either write your own, or find a way to embed existing code in your own language. This is not easy so yes, there is a major flaw you are not seeing.

share|improve this answer

I'd say that the flaw in your reasoning is that you assume that any wannabe reverse-engineer would be interested in your source code. In fact, for reverse-engineering, attackers are interested in a "source code" form which allows for whatever goal the attacker is after, usually understanding a small piece of algorithm. The format for Java bytecode is sufficiently regular and simple that it can be managed directly for that kind of job.

So an attacker could simply run a disassembler (like this one) and possibly a corresponding assembler (like that one) to test his modifications or insert extra debugging calls. He can do that on the compiled .class files, regardless of whatever programming language you used on your side.

This is not new. People have been reverse-engineering C or C++ applications for decades, by looking at the assembly.

share|improve this answer

In order to modify my game's code, the hacker would have to learn my custom language and create their own custom decompiler which would take some time. At least how I figure.

A hacker does not need to decompile all the way to your custom language. The hacker would just need to find and recognize the place in the byte code where the code decrements the number of lives left, and change that into an increment. There is no need for a full decompile.

share|improve this answer

I would recommend using an already available obfuscation tool. DexGuard is one such code obfuscator that offers some level of protection for Android applications. I'd guess it'd be better to use the product of a developer's whose sole focus is obfuscation rather than write your own and hence also have more time to focus on your game development.

As with all kinds of code packing, this merely increases the complexity of reversing and a determined attacker could always find a way through.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.