As far as my basic understanding goes, when you encrypt files, you would need the private key to access and read them. I think Unreal Engine 4 does this using .pak files and the private key is stored somewhere? I have tried reading files from games such as Fortnite and it seems impossible without the key.

So my other questions are:

  1. Would this ensure players could not edit game files and scripts?
  2. If so would this be possible to do for a beginner like me, and if using Unity?
  • There are many types of hacking... if you're worried about the integrity of the game system for a multi-player game, focus on adding protections in the server to prevent players from doing things that are not realistic. Encrypting game files is usually more of a defense to protect your technical and artistic assets. You can always add encryption to a file format later, but a game with poor input validation is much harder to correct after release. – nbering Jun 23 '18 at 19:17
  • 1
    It's almost completely useless. As @nbering says, you need to do as much as you can server-side (validate plausible player actions, ensure that no two players can deal more damage than possible even with critical hits or special skills, etc), and assume that everything client-side is an open box. – forest Jun 23 '18 at 19:26

Encryption is not authentication.

Protecting the contents of a file from being read and protecting the contents of a file from being modified are two separate tasks. This is particularly apparent when trying to secure the contents of your game's files - the game needs to decrypt them, so it needs to have the secret...which means the user, who has total control over their own machine, also has the secret! Even ignoring that, the files still need to be loaded into memory sans encryption at some point, so the data can be seen.

Authentication, on the other hand, could be done by signing the game's files with a private key (which never leaves the developer's clutches), and then later verifying them with a public key (which is distributed along with the game).

Now an adversary who can see everything is unable to modify the game's files. They don't even need to be encrypted; any change will cause the signature to become invalid.

...Unfortunately, of course, the end user can just patch out the routine that verifies the game files in the first place.

This becomes a game of cat-and-mouse. Ultimately, it's a losing battle for the developer; it's like trying to keep out robbers by asking them very nicely to stay away.

So what to do?

The client is totally untrustworthy. The client can lie and cheat and steal 'til the cows come home. If your game's logic lives on the side of the client, the game's logic can be subverted.

On the other hand, if your game is hosted on a system you control, you have some power. You can decide "hey, JimBob just moved fifty miles in two seconds; maybe that isn't right." The client can still be a horrible liar, and still abuse information they shouldn't have (like seeing enemies through walls), but you can at least verify that their actions are valid.

The same tenant comes up in all sorts of places. Web developers validate every input, even if the UI doesn't allow you to say you're potato years old.

So, at the end of the day, trust the client as little as possible.

| improve this answer | |
  • Wow! Thank you for that great explanation, the way you wrote it made it very easy to understand. So I guess even games like fortnite aren't totally secure, and if someone tried hard enough they would find a way to get wall hacks or something? I will try making my server authoritative, and if someone manages to get wallhacks, my game is already big. My game probably won't ever get enough players to make it worth anyone trying to hack it, but it would be cool to see if someone could find a loophole. Thanks again, this saved me a lot of time and now I don't have to learn how to encrypt my files. – Bureto Jun 23 '18 at 22:19
  • You're welcome (: . I'm not too familiar with how cheats are actually developed; I know that many work by inspecting what's in memory / simulating player input based on what's seen, though. To protect against things like wallhacks, you can try only sending information to the player if it might actually be perceptible (so don't update enemies if they're behind five walls!) Beyond that, most large games focus on detecting cheating behavior, either by using nosey things like VAC/BattleEye/etc., or by detecting when players are doing really weird stuff. – chemicalcrux Jun 23 '18 at 22:32
  • As mentioned, as long as it doesn’t affect performance too much, the best defense is to move the logic to the server. Tell the server the client pushed the button and have the server tell the client what affect that had. This is often too slow for action games like the FPS genre, though. And may need some work-arounds for mechanics like movement for RPGs. Let the client assume the command will be completed as expected and jitter back if it doesn’t. – nbering Jun 25 '18 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.