1

I want to make my game extremely hard to decompile. So I've come up with the idea of a program which will contain my game's code, coded in a custom language, and which will translate that code into Java code during runtime. (So it's kind of like a virtual machine is running on top of Java's virtual machine, or at least the way I see it.)

In order to modify my game's code, the hacker would have to learn my custom language and create their own custom decompiler which would take some time. At least how I figure.

Is there any name for this kind of approach? Has it been done before? Is there a flaw I'm not seeing?

  • The most relevant term for this I could think of is source code obfuscation, but what you propose wouldn't work to your advantage. What would stop anyone from reverse-engineering your own decompiled output before it's fed to Java's JIT? – TildalWave Jul 27 '13 at 13:38
  • Custom byte code is quite common in obfuscators. – CodesInChaos Jul 27 '13 at 13:55
  • Why wouldn't decompiling "halfway" to Java be sufficient or even prefereable for the hacker's goals? – Peteris Dec 21 '16 at 19:31
6

Is there a flaw I'm not seeing?

You have to create your own custom language. You will not have access to tools such as IDE's and debuggers that makes writing code in that language easier. You have to write a translator to translate your custom language into Java bytecode. You will not have access to ready made libraries for a large set of features so you will have to either write your own, or find a way to embed existing code in your own language. This is not easy so yes, there is a major flaw you are not seeing.

  • Libraries access and language are two different concerns. It is much easier to write an interface wrapper for a library that to recode it in a new language, specially if the original language is fully compiled like C. – Serge Ballesta Dec 21 '16 at 19:40
7

I'd say that the flaw in your reasoning is that you assume that any wannabe reverse-engineer would be interested in your source code. In fact, for reverse-engineering, attackers are interested in a "source code" form which allows for whatever goal the attacker is after, usually understanding a small piece of algorithm. The format for Java bytecode is sufficiently regular and simple that it can be managed directly for that kind of job.

So an attacker could simply run a disassembler (like this one) and possibly a corresponding assembler (like that one) to test his modifications or insert extra debugging calls. He can do that on the compiled .class files, regardless of whatever programming language you used on your side.

This is not new. People have been reverse-engineering C or C++ applications for decades, by looking at the assembly.

2

In order to modify my game's code, the hacker would have to learn my custom language and create their own custom decompiler which would take some time. At least how I figure.

A hacker does not need to decompile all the way to your custom language. The hacker would just need to find and recognize the place in the byte code where the code decrements the number of lives left, and change that into an increment. There is no need for a full decompile.

2

If I understood correctly you are doing the following translations:

Custom language > Java > Java bytecode

Meanwhile the hacker can directly use the Java bytecode to learn how your game works

I won't recommend you going that way, it adds you the complexity of coding a translator that won't give you any protection but will give you more headaches as you won't be able to use any IDE or use libraries directly

What you can do to difficult in the same level the task of reverse engineering is using a code obfuscator. It'll give you all the advantages of using standard Java (Including IDE and libraries) and doesn't need a custom language and translator

1

I would recommend using an already available obfuscation tool. DexGuard is one such code obfuscator that offers some level of protection for Android applications. I'd guess it'd be better to use the product of a developer's whose sole focus is obfuscation rather than write your own and hence also have more time to focus on your game development.

As with all kinds of code packing, this merely increases the complexity of reversing and a determined attacker could always find a way through.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.