Anti-Cheat Toolkit: stop cheaters easily!

codestage · August 19, 2013, 11:19pm

Dear Unity3D developers, I’m glad to share with you my first Asset Store contribution: Anti-Cheat Toolkit (ACTk)!

ACTk will save you a lot of development effort hours and bring handcrafted years of anti-cheat expertise and experience.

Serves both as an easy to use out-of-the-box solution and as a powerful tool in a professional hand which can be flexible enough to complement any other anti-cheat measures you implement.

Regular price: $80
Or get in a bundle for a cheaper price!

WebGL DEMO

Common features

Protects variables in memory.
Protects and extends Player Prefs and binary files.
Generates build code signature for tampering checks.
Detects or allows detecting:
• non Play Store installations on Android
• speedhacks and wallhacks
• time cheating
• managed assemblies injections
Has Obscured Prefs / Player Prefs editor.

Read further to find out more about each feature.

Obscured Types tutorial

Keeps your sensitive variables away from all memory scanners and searchers.
All basic and few Unity-specific types are covered.
Detects cheating attempts.

Obscured Prefs & Obscured File

Protects Player Prefs and binary files from common cheating threats:
• identify and read sensitive data (encryption)
• tamper sensitive data (genuine check)
• share cheated files \ saves with more cheaters (device or user ID lock)

Obscured Prefs highlights**:**
• automatic data migration
• automatic crypto keys management
• simple generic API and more data types comparing to vanilla Player Prefs
• Player Prefs and Obscured Prefs editor window
Obscured Prefs tutorial

Obscured File & Obscured File Prefs highlights**:**
• background threads-friendly (to avoid IO hiccups)
• simple and easy to use Player Prefs-alike API wrapper
Obscured File & Obscured File Prefs tutorial

Code Hash Generator

Generates a code hash signature (both in Editor and Runtime) to compare against the current hash and make sure compiled code was not altered.
Provides hashes for both whole build and separate files in build (helpful for aab Android App Bundles).
Uses background threads to calculate hashes, keeping CPU footprint low.
For Windows Standalone and Android only so far.

Android App Installation Source Validator

Makes you aware from what source your game was installed, be it Google Play, Galaxy Store, manual installation via Package Installer or something else.

Android Screen Recording prevention

Allows easily enable or disable screenshot and screen recording prevention for most non-rooted Android-based operating systems.

Speed Hack Detector tutorial

Makes you aware of nasty cheaters trying to slow down or speed up your game.
Correctly reacts to the time glitches.
Allows to resist speed hacks with SpeedHackProofTime class.

Time Cheating Detector

Uses Internet connection to get reliable time.
Reacts to both incorrect system time and actual cheating during or between sessions, allowing you to catch people who change time to speedup long-term processes (like building process, energy restore, etc).
Works with weak internet connection.

WallHack Detector tutorial

Covers 3 common wall hack types:
• shoot through the walls
• walk through the walls
• look through the walls
Uses generic sandbox approach allowing to detect unknown cheats.

Injection Detector tutorial

Reacts on foreign managed Mono assemblies both injected at runtime or into the build on PC and Android.

Third-party plugins

• actions for Opsive’s Behavior Designer
• actions for PlayMaker (except obscured types due to PM limitations)
• works great with Simple IAP System to process & validate IAPs online with Receipt Validation service
• works great with Cross-Platform Native Plugins to save into the cloud, setup leaderboards and more!
• used in Lovatto Studio MFPS Anti-Cheat And Reporting addon
• used in Stan’s Android Native asset

Resist reverse-engineering threat:
• Protect IL2CPP build with Mfuscator

Compatibility

Supports Unity 2019.4 LTS and newer.

Works on all actual platforms including IL2CPP builds with few limitations:
• Windows Standalone and Android are supported by Code Hash Generator at this moment.
• Injection Detector supports Mono builds only since IL2CPP can’t have managed injections.

Documentation

• API Reference
• Readme.pdf User Manual (included in the package) with samples, additional details and helpful pro-tips

Overall highlights

Easy to start:
• detailed User Manual with examples and tips
• examples scene
• video tutorials

Easy to extend:
• full API Reference
• full C# sources included!
• explore, learn, extend and build fully customized anti-cheat solution for your games!

Support and updates since 2013

Skilled and motivated cheaters can break any protection, and thus it’s not guaranteed your game will be 100% safe from all cheaters if you’ll use this toolkit. Though, massive “casual” cheating can be eliminated for good.
Where to go from here

Like it? Hate it? Leave a review at the Asset Store to help others to make a good choice.

Need support, have any questions, suggestions or any other feedback?
Here are options for you:

chat online at the Code Stage Discord server
get in touch over email
communicate here, on forums ^^

P.S. No holy wars about cheating/hacking protection methods please

Demigiant · August 19, 2013, 11:46pm

I already used ACT with my games, and I can only say it’s awesome. Incredibly simple to implement, and very effective

codestage · August 20, 2013, 12:08am

Thanks for your feedback, Daniele, as always!

Zeblote · August 20, 2013, 12:30am

Maybe upload an example project (the button one is enough) to test it?

codestage · August 20, 2013, 8:53am

Sure, you can try it here: http://codestage.ru/unity/anti-cheat/demo/

codestage · August 22, 2013, 7:21pm

Version 1.0.0.7 is sent to Asset Store team for review!

New in 1.0.0.7

Fixed error in ObscuredString (now it works in WebPlayer without errors).
Fixed error in ObscuredFloat (now it works in WebPlayer without errors).
ObscuredFloat is memory wiser now.
ObscuredFloat.SetNewCryptoKey() accepts int now (was long).
Added changelog

And I created a small page for ACT with changelog and some extra info: http://blog.codestage.ru/act/

Crazy_Robot · August 22, 2013, 7:30pm

Sounds great,

But how does it work on mobile (iOS, Android, Windows Phone, Blackberry)?

Thanks,

codestage · August 23, 2013, 10:30am

Hey, Crazy Robot!
It should work on mobile same as on desktops - I’m trying to keep it platform independent!
Some additional testing is still needed though (I tested it on Android mobile platform only so far, but it should be fine on iOS and all other mobile platforms as well).

codestage · August 24, 2013, 10:49am

1.0.0.8 is out!

New in 1.0.0.8

PlayerPrefsObscured now able to lock saved data to the current device. See PlayerPrefsObscured.lockToDevice field description in API docs.
Improved PlayerPrefsObscured stability and obscuration strength (use Get*Deprecated() methods to load data, saved with ACT 1.0.0.6 or earlier)
PlayerPrefsObscured now has own encryption key. Use PlayerPrefsObscured.SetNewCryptoKey() to change it from default value.
Created home page for ACT: http://blog.codestage.ru/act/

Asset Store guys can’t overtake me

P.S.: Yey, demo video got 100 views on YouTube!

codestage · September 5, 2013, 9:24pm

Latest 1.0.0.9 update was approved at Asset Store (finally)!
It includes one tiny yet important fix:

Fixed data loss in PlayerPrefsObscured (use Get*Deprecated to read data saved with ACT 1.0.0.8 version)

PrisedRabbit · September 30, 2013, 8:44am

What happened with ACT on the Asset Store? Where I can find this tool?

codestage · September 30, 2013, 9:42am

Hey, mrbroshkin, ACT was removed from Asset Store accidentally, I’m working on this issue, sorry for any inconvenience.
Feel free to subscribe to this thread - I’ll post here as ACT will be restored.

Thank you for your interest in ACT.

codestage · September 30, 2013, 5:01pm

Hey everyone, I’m glad to let you know, issue with ACT availability is fixed now, Anti-Cheat Toolkit is available for purchase at the usual link in Asset Store (https://www.assetstore.unity3d.com/#/content/10395/)!

MachCUBED · October 19, 2013, 12:36am

Hi Dmitriy,

Great project, but before I download it, I’d like to ask a question about iOS export compliance: if I integrate your plug-in into my app, will I have to get permission in order to export my app? You can find details here: http://stackoverflow.com/questions/10973567/what-constitutes-encryption-for-the-purpose-of-export-compliance-e-g-in-app

Thanks in advance, if I can get a good answer, I will be able to switch over from SecurePlayerPrefs and/or CryptoPlayerPrefs (I can’t seem to find any information on whether or not either one complies with US cryptography export regulations).

MachCUBED

codestage · October 19, 2013, 1:12am

Hey, MachCUBED!

Current Anti-Cheat Toolkit version have simple and fastest possible symmetric encryption with key not exceeding 56 bits implemented under the hood.
And this encryption is used to protect developer’s intellectual property by hiding from hackers and cheaters sensitive information.
These facts should claim exemption from the review accordingly to the information from page you linked to. Well, I think so, but not sure for 100%.

Anyway, I’m open for discussion and will be glad to fix any issues you may encounter with my plugin while using it (even after buying, cough).

BTW, I’ll spoil a bit upcoming update - it will have additional hashing implemented (not encryption) to allow you “sign” your assemblies in Unity IDE (prob automatically, after Assemblies reloading) and check if assemblies are genuine at runtime just like you do with Application.genuine on iOS, but it will check assemblies only (if regular Application.genuine is not available) on desktops and all (I hope) mobile players (Flash Player and Web Player dismissed here, sorry), allowing you to react on cheaters, trying to alter your assemblies. It’s WIP, so I’ll post here more details about it as update will be ready for public.

Please, let me know if you have any further questions on my plugin, and thanks for your interest in ACT!

codestage · October 19, 2013, 9:30pm

Anti-Cheat Toolkit 1.0.1.0 update is ready and was sent to the Asset Store team for review (and ready for download by any customer)!

Added Assemblies signing functionality * EXPERIMENTAL *
Fixed web player detection, now ObscuredFloat can be used in static conditions (thanks Andriy Pidvirnyy)

I’ll quote here piece of the readme.pdf about new feature:

"Game code assemblies altering detection (experimental)

WARNING #1: Flash Player and Web Player are not supported!
WARNING #2: Requires Disabled Stripping Level in the Player Settings!
WARNING #3: This feature is in experimental state ATM and should not be used in production!

You could notice new menu in your Unity3D IDE: Anti-Cheat Toolkit - > Options and small window appearing after clicking that menu item.
Please, note this “Sign assemblies automatically” option here.

If you’ll select it, all custom assemblies (that unity compiles from all plain sources in your project) will be signed each time Unity IDE recompiles them. These signatures will be written in the Resources/fn.txt file at the root of your Assets folder.
This file is required to check assemblies signatures at runtime, so please, keep it in-place.

Now let me show you how to use it in your app:
// place this line right in the beginning of your .cs file!
using CodeStage.AntiCheat.Signing;

// call this method before trying to detect assemblies altering
if (IntegrityChecker.IntegrityCheckAvailable())
{
    // will print true or false depending on application integrity
    Debug.Log("Are current app assemblies altered: " + IntegrityChecker.Valid());
}
This is all you need to add check for application assemblies integrity!
Think of it as about usual Application.genuine functionality, but working at all desktop builds and mobile players. It tries to combine custom assemblies integrity checking algorithm with regular Application.genuine check to leverage as many platforms as possible. If regular Application.genuine is not available, it will make assemblies only integrity check.

Of course, these methods can be hacked as anything around. I started developing it with few things in mind:

hacker may not notice this methods first time he will alter your game assemblies, so your app still have chance to figure out it was hacked and send to you hacker’s IP before he’ll notice this

many devs wish to implement such additional layer to the Application.genuine, so they no need waste their time on this anymore

it’s fun!"

In addition I’d like to mention any additional precompiled assemblies used in your project will not be checked for integrity ATM, this is possible to add in future updates.

MachCUBED · October 22, 2013, 12:44am

Thank you for your response Dmitriy. For further discussion, I have found Apple’s own guide:

The information is under “Authorizing for Export and Indicating Legal Issues” on the linked page and provides further details on Apple’s export compliance. I am posting this because although your solution probably complies because it uses 56-bit symmetric encryption, you also said that you’re not 100% sure of the requirements.

MachCUBED.

codestage · October 22, 2013, 9:57am

I see, thanks for your addition.
I read about it a bit more and looks like all this crazy export stuff can be avoided using 7 byte or shorter keys for all Obscured variables to make encryption not satisfying for “symmetric encryption” as described in the a.1.a. of Category 5 Part 2 (of Bureau of Industry and Security Commerce Control List) thus not being threaten as “Information Security” in Note.4 a.1 of the Category 5 Part 2 document, thus allowing you to choose “Yes” for second question of the Apple’s Export Compliance survey.
Well, I think this is so, I have not enough lawyer skills to be 100% sure in this though.

I use keys <= 56 bit for all Obscured types except ObscuredInt (it has 64 bit key, I’ll shorten it in future version) by default. But I provide APIs to change encryption keys from default values for all Obscured types: SetNewCryptoKey(newKey), so just make sure you’re setting there short enough keys and you should be safe.

Actually I assume most users will use this API to change default encryption keys to increase their app security level a bit. Maybe I should add a kind of warning if default key is still not changed, I’ll think about it.

PS: If someone wish to obtain CCATS, here is a short guide for obtaining CCATS for your APP:
http://zetetic.net/blog/2009/8/3/mass-market-encryption-ccats-commodity-classification-for-ip.html

codestage · October 25, 2013, 10:19pm

Latest 1.0.1.2 update is available at Asset Store!

1.0.1.2

fixed .meta files handling
moved Anti-Cheat Toolkit/Options menu item to the Window/Anti-Cheat Toolkit/Options
moved plugin into CodeStage directory (to compact placing of any future plugins I’ll release)
reduced ObscuredInt default key length
attempt to fix async assemblies reloading issue

1.0.1.1

Added assemblies signing process duration estimation
Fixed issues with Anti-Cheat Toolkit .dll import in Unity 4.x

sonicviz · October 26, 2013, 3:00pm

Afaik it’s no big deal to answer the encryption question for the AppStores as long as you have registered at BIS SNAP-R Registration

More info:
http://tigelane.blogspot.jp/2011/01/apple-itunes-export-restrictions-on.html

I’m pretty certain the bis / encryption question system is just in place so the NSA has a nice register of apps to check without having to hunt for them;-)