I've programmed an Android game with Unity Engine. As you know in Unity, scripts compiled into one file named "Assembly-CSharp.dll". I wrote my scripts in C#.
After I compiled whole game into .apk, I renamed it to .zip and dragged the Assembly-CSharp.dll into tools like ILSpy, while the whole program was fully decompiled with all of the details like my RSA public key or AES password, IV, salt ...
The logic of my app is client (Android) and server (Java).
When player finished a level, with this URL: http://www.example.com:8080/MyApp/SaveScores.do?hash=labla....labla, we give him score. The real parameters are username, score, timestamp. Our encryption algorithm is RSA 1024 bit.
When cheater/attacker sniffs HTTP traffic to use replay attack, we check the decrypted hash with RSA and with timestamp parameter we kick him out.
But when he decompiled code beautifully with tools (ILSpy) he simply find my public key and find out that I encrypt user score and timestamp with that publickey. Then, he will write a Unity or C# programm to simply encrypt his manipulated message with a new timestamp and he will be trusted in my server side app because anything is true.
He will increase his score with posting HTTP requests to server without playing the game. He can simply cheat.
What can I do?
- I can't use SSL.
- With obfuscating, only crack time will increase.
- With giving public key at runtime from server to client, memory checkers or traffic sniffers can simply see public key.