Author Topic: Aurora C# Code Protection  (Read 22752 times)

0 Members and 1 Guest are viewing this topic.

Offline Retropunch

  • Petty Officer
  • **
  • R
  • Posts: 18
  • Thanked: 6 times
Re: Aurora C# Code Protection
« Reply #45 on: December 06, 2018, 04:05:05 PM »
I'd completely agree with a checksum - I'd also add that putting a bug report button in the program itself may help; it could automatically deliver the checksum (as well as any other variables you wanted it to pass) and save a lot of hassle.


There already is decent enough mod support built in (or there was) in terms of naming/flags/colours etc. The thing most people want to do in terms of modding is play as their own race/kingdom against other preset ones (Stargate/Star Wars/Trek etc.) - as such I don't think there's any need to cover anything else which would be a lot more work.
 

Offline Alucard

  • Petty Officer
  • **
  • A
  • Posts: 24
  • Thanked: 32 times
Re: Aurora C# Code Protection
« Reply #46 on: December 09, 2018, 04:01:54 PM »
Quote from: Retropunch link=topic=10217. msg111281#msg111281 date=1544133905
There already is decent enough mod support built in (or there was) in terms of naming/flags/colours etc.  The thing most people want to do in terms of modding is play as their own race/kingdom against other preset ones (Stargate/Star Wars/Trek etc. ) - as such I don't think there's any need to cover anything else which would be a lot more work.

There are many different types of mods, that could be made, if there is source or at least no protection against injection. 
One type I can imagine being popular is a mod, that would bring the game mechanics to correspond closer to some fictional universe. For example Battlestar Galactica mod making point defense for large ships next to useless while making missile interception by fighters much easier + making missiles much more expensive.  It could also add sort of fleet persuit similar to the show and maybe change hangars and on-board production modules.
 

Offline ab9rf

  • Able Ordinary Rate
  • a
  • Posts: 2
  • Thanked: 3 times
Re: Aurora C# Code Protection
« Reply #47 on: January 18, 2019, 01:58:36 PM »
Quote from: Barkhorn link=topic=10217. msg110990#msg110990 date=1541824500
I understand you want control over the code, but I'd just like to point out what another dev has done in a similar situation.

Dwarf Fortress is a similarly complex game made mostly by one guy, Tarn Adams.   He protects his game with licensing, not code obfuscation.   He also allows some pretty serious modding, but hasn't actually endorsed most of it.   I don't fully understand it, but DFHack is a very popular utility that allows third-party scripts to access Dwarf Fortress's RAM.   This utility allows the player to use tons of scripts that drastically improve their quality of life.   A few examples include quicker bugfixes, mouse support, even 3D graphics.

I am totally fine with it if you don't want other people toying with your code, but just know that other games with similar communities have greatly benefited from openness.
I'm a minor participant in the DFHack project.  Dwarf Fortress is in C++, which makes it much harder to decompile than something written in C#.  Tarn takes no specific steps to obfuscate his code because he doesn't have to: it's compiled to native machine code, and with modern compilers, that makes it essentially fully obfuscated by default.  We can't even reliably identify classes that don't have virtual methods.  Even identifying function boundaries in the compiled machine code is challenging, due to inlining.  Despite all that, DFHack exists.  Tarn seems to tolerate us fairly well.  We've done a lot to help with this by being persistently respectful of his efforts and by providing useful feedback about the bugs we find in the course of our explorations.

C# code (when compiled to the CIL, at least, which is the default) is frankly trivial to decompile.  About all you can do is obfuscate variable names.  With baseline obfuscation, all (or essentially all) of the classes and methods you define in your source will be recoverable from the compiled code; all that will be lost is the names you gave them (and possibly also any code the compiler has identified as dead).  This is, essentially, the same obfuscation that Mojang uses to obfuscate Minecraft.  The thousands of mods that exist for Minecraft should tell you how successful that has been. 
Some of the . NET obfuscators do things to your code that make it harder to decompile (with varying degrees of success), but also make it slower.  But all of these methods are reversible, and frankly none of them is more difficult to reverse than the "obfuscation" that compiling C++ to machine language does.

It is essentially impossible to stop people from modding a managed . NET executable.  However, at the same time, it's unlikely that the people who do such modding will be dicks about it.  However, the fact that decompiling C# is much easier than decompiling C++ does suggest that the probability of at least one asshole modder popping up is somewhat higher than it is for the C++ case exemplified by Dwarf Fortress.
 
The following users thanked this post: Steve Walmsley, Karlito, UberWaffe

Offline Whitecold

  • Commander
  • *********
  • W
  • Posts: 330
  • Thanked: 88 times
Re: Aurora C# Code Protection
« Reply #48 on: January 19, 2019, 10:55:04 AM »
Quote from: Barkhorn link=topic=10217. msg110990#msg110990 date=1541824500
I understand you want control over the code, but I'd just like to point out what another dev has done in a similar situation.

Dwarf Fortress is a similarly complex game made mostly by one guy, Tarn Adams.   He protects his game with licensing, not code obfuscation.   He also allows some pretty serious modding, but hasn't actually endorsed most of it.   I don't fully understand it, but DFHack is a very popular utility that allows third-party scripts to access Dwarf Fortress's RAM.   This utility allows the player to use tons of scripts that drastically improve their quality of life.   A few examples include quicker bugfixes, mouse support, even 3D graphics.

I am totally fine with it if you don't want other people toying with your code, but just know that other games with similar communities have greatly benefited from openness.
I'm a minor participant in the DFHack project.  Dwarf Fortress is in C++, which makes it much harder to decompile than something written in C#.  Tarn takes no specific steps to obfuscate his code because he doesn't have to: it's compiled to native machine code, and with modern compilers, that makes it essentially fully obfuscated by default.  We can't even reliably identify classes that don't have virtual methods.  Even identifying function boundaries in the compiled machine code is challenging, due to inlining.  Despite all that, DFHack exists.  Tarn seems to tolerate us fairly well.  We've done a lot to help with this by being persistently respectful of his efforts and by providing useful feedback about the bugs we find in the course of our explorations.

C# code (when compiled to the CIL, at least, which is the default) is frankly trivial to decompile.  About all you can do is obfuscate variable names.  With baseline obfuscation, all (or essentially all) of the classes and methods you define in your source will be recoverable from the compiled code; all that will be lost is the names you gave them (and possibly also any code the compiler has identified as dead).  This is, essentially, the same obfuscation that Mojang uses to obfuscate Minecraft.  The thousands of mods that exist for Minecraft should tell you how successful that has been. 
Some of the . NET obfuscators do things to your code that make it harder to decompile (with varying degrees of success), but also make it slower.  But all of these methods are reversible, and frankly none of them is more difficult to reverse than the "obfuscation" that compiling C++ to machine language does.

It is essentially impossible to stop people from modding a managed . NET executable.  However, at the same time, it's unlikely that the people who do such modding will be dicks about it.  However, the fact that decompiling C# is much easier than decompiling C++ does suggest that the probability of at least one asshole modder popping up is somewhat higher than it is for the C++ case exemplified by Dwarf Fortress.

DFhack is a wonderful project making Dwarf Fortress much more user friendly with some of the management tools that make you forget that it is not actually part of vanilla. But DFhack is insofar officially endorsed as it has its own section on the forums. Without the forum and mentions on the wiki, I doubt many people would even know about it.
So as far as the problem of bug reports caused by mods go it should be sufficient to just not offer any platform. It tends to be the people that downloaded a mod, installed it and it does a weird thing that come running back claiming a bug. If you do any modding work yourself, you know very well any bug is most likely created by yourself.
 
The following users thanked this post: Karlito

Offline MarcAFK

  • Vice Admiral
  • **********
  • Posts: 2005
  • Thanked: 134 times
  • ...it's so simple an idiot could have devised it..
Re: Aurora C# Code Protection
« Reply #49 on: February 13, 2019, 08:07:24 PM »
In the case of DFhack there is a significant amount of people who probably wouldn't be able to play without the extra tools it provides, specifically I'm talking about therapist, which is bundled with DF hack these days if I'm not mistaken.
" Why is this godforsaken hellhole worth dying for? "
". . .  We know nothing about them, their language, their history or what they look like.  But we can assume this.  They stand for everything we don't stand for.  Also they told me you guys look like dorks. "
"Stop exploding, you cowards.  "
 

Offline tobijon

  • Warrant Officer, Class 1
  • *****
  • t
  • Posts: 91
  • Thanked: 11 times
Re: Aurora C# Code Protection
« Reply #50 on: February 14, 2019, 05:31:50 AM »
In the case of DFhack there is a significant amount of people who probably wouldn't be able to play without the extra tools it provides, specifically I'm talking about therapist, which is bundled with DF hack these days if I'm not mistaken.

no you can get therapist separately, I never actually use hack but I do use therapist
 

Offline Garfunkel

  • Registered
  • Admiral of the Fleet
  • ***********
  • Posts: 2781
  • Thanked: 1047 times
Re: Aurora C# Code Protection
« Reply #51 on: February 14, 2019, 11:27:10 AM »
There are packs that bundle both together and make installing and setting them up easy, but they are also available separately.
 

Offline QuakeIV

  • Registered
  • Commodore
  • **********
  • Posts: 759
  • Thanked: 168 times
Re: Aurora C# Code Protection
« Reply #52 on: February 15, 2019, 03:21:32 PM »
Therapist is built on top of the DFHack teams memory maps, you are arguably using a DFHack plugin by using therapist.
 

Offline HavingPhun

  • Leading Rate
  • *
  • Posts: 5
Re: Aurora C# Code Protection
« Reply #53 on: February 16, 2019, 12:16:27 PM »
I wonder if using a tool which compiles your c# to machine code directly instead of IL would help? Looks like . NET Native can do that for you.  Might be the case that there's still a lot of info left behind for use with reflection, but still, it's an option that you could look into.  I'd imagine it would at least increase the barrier of entry for people trying to reverse the game.  Instead of being able to use an off the shelf deobfuscator and IL decompiler.  Anyone have experience with . NET native?
 

Offline Steve Walmsley (OP)

  • Moderator
  • Star Marshal
  • *****
  • S
  • Posts: 11649
  • Thanked: 20349 times
Re: Aurora C# Code Protection
« Reply #54 on: February 16, 2019, 03:22:49 PM »
I wonder if using a tool which compiles your c# to machine code directly instead of IL would help? Looks like . NET Native can do that for you.  Might be the case that there's still a lot of info left behind for use with reflection, but still, it's an option that you could look into.  I'd imagine it would at least increase the barrier of entry for people trying to reverse the game.  Instead of being able to use an off the shelf deobfuscator and IL decompiler.  Anyone have experience with . NET native?

Thanks - I will take a look.
 

Offline Myvar

  • Leading Rate
  • *
  • Posts: 10
  • Thanked: 17 times
Re: Aurora C# Code Protection
« Reply #55 on: February 17, 2019, 12:16:28 AM »
I have played around with . net native, and it only helps out the JIT by pre compiling some of the bootstrap code to AOT, so it will not help, granted last time i tried it was years a go so things might be different, now a days.
 

Offline TinkerPox

  • MIDN
  • Petty Officer
  • **
  • Posts: 15
  • Thanked: 4 times
Re: Aurora C# Code Protection
« Reply #56 on: March 07, 2019, 10:12:33 AM »
Hey Ghidra was just released, which allows decompilation/disassembly to reveal, then analyze source code. 
 

Offline TMaekler

  • Vice Admiral
  • **********
  • Posts: 1112
  • Thanked: 298 times
Re: Aurora C# Code Protection
« Reply #57 on: March 08, 2019, 03:45:57 AM »
Hey Ghidra was just released, which allows decompilation/disassembly to reveal, then analyze source code.
Wow. Looks like good bye to keeping your code to yourself, I guess... .
 

Offline Scandinavian

  • Lieutenant
  • *******
  • S
  • Posts: 158
  • Thanked: 55 times
Re: Aurora C# Code Protection
« Reply #58 on: March 08, 2019, 05:41:41 AM »
You can still make them work a little for it by running your code through an obfuscator that strips out all the comments, indentation, and other superfluous characters, and renames all the variables to VARIABLE[running number]. A decompiler may be able to correctly reconstruct the original code, but for a program of any real size it would still be unreadable gibberish.
 

Offline MarcAFK

  • Vice Admiral
  • **********
  • Posts: 2005
  • Thanked: 134 times
  • ...it's so simple an idiot could have devised it..
Re: Aurora C# Code Protection
« Reply #59 on: March 08, 2019, 07:18:08 AM »
You underestimate the capability of anyone with enough skill and determination, hell people program in machine code. Even I can use memory trainers for modding console games running on an emulator and thats basically just brute forcing numbers and seeing what breaks and what doesn't :s.
I'm no coder though :/
" Why is this godforsaken hellhole worth dying for? "
". . .  We know nothing about them, their language, their history or what they look like.  But we can assume this.  They stand for everything we don't stand for.  Also they told me you guys look like dorks. "
"Stop exploding, you cowards.  "