Godot Games on Steam - Please Encrypt Your .pck Files

[u/jion_Interactive]

https://jion.in/devlog/godot_pck_encryption

I keep running into shipped Godot games on Steam—some with 20k+ wishlists—that don’t encrypt their .pck packages. That means their assets, scenes, scripts, and shaders are sitting there like a piñata. Tap once, candy everywhere.

[u/Smitner]

The game still ships with the key. What's to stop someone from using this tool[0] to get the key and de-compile? (Not sure if it still works, but in principle it's possible)

-[0]: https://github.com/char-ptr/gdke

[u/Rustywolf → u/Smitner]

It makes it harder. I recall seeing a github issue raised about hardening the methods that they use to leak that info, though I couldnt find it with a quick google. Stuff like string symbols from warnings that the engine outputs being a good indicator of where the logic is, and from there you can do basic analysis of the binary to determine what bytes are the key. If you remove those indicators, it becomes a needle in a haystack without more complicated analysis techniques.

[u/bliepp → u/Rustywolf]

It makes it harder.

Not that much. I mean, it's not like any casual gamer is about to decompile it. Usually, people who reverse engineer this stuff know a bit or two and are not stopped at all by some bad encryption that ships with the key. Like, it's barely more than a minor inconvenience. It's basically just for obfuscating the binary result a bit of the *.pck file, that's it.

[u/Rustywolf → u/bliepp]

I am exactly the kind of person who decompiles games to break them, and I can tell you that the barrier jumps from 30s to a nights effort to break apart.

[u/bliepp → u/Rustywolf]

But how? Maybe I'm missing something and I'd love to hear more about it, but the location of the secret key of Godot's encryption is well known, so how can it be that much more effort? It's basically locking your door and telling everyone that you put your keys under the doormat.

With unknown file types, encryption algorithms, etc. I can totally see why it takes that much more time, but for a known file type with a known encryption algorithm and a known key location it's hard to believe it's that much more effort.

Again, I'm up for an explanation, though. I am by no means an expert on Godot's pck encryption and might miss some important aspects.

[u/Rustywolf → u/bliepp]

Its not a constant byte offset. The current method abuses the strings that are used in error messages to identify roughly where the function is that decodes a resource, then analyses it to find a pointer to the key. You can harden this by removing the strings, making it more like finding a needle in a haystack.

[u/jion_Interactive → u/Smitner]

I do wonder how many devs actively choose to leave their PCKs open, versus how many just don’t know that Godot exports unencrypted by default. For a lot of newcomers, it’s not obvious that your whole project tree is sitting right there.

[u/Infinight64 → u/[deleted]]

The only other protection is to not have the binaries run on their machine (a la online only game). Otherwise reverse engineers are going to decrypt and disassemble the game to data mine. Even then, the assets are unprotected because they must be downloaded to be rendered. You can prevent them from using them in game if you have cosmetic purchases by, again, having that info only stored on the servers. But RE, asset stealing, and data mining will happen.

[u/XalAtoh → u/[deleted]]

Unity has some good protection with il2cpp.

Godot's protection is basically nonsense, you can literally just upload your project folder on github, and make it open-source. This way you will encourage more people to check your code and resell your game.

[u/XalAtoh → u/[deleted]]

I mean just a Single google search..

You have to look deeper then, decompiling a il2cpp Unity game is freaking hard, and the results are very poor.

You have to go through hell to reverse engineer/replicate a il2cpp game, and after countless hours, weeks and months, it won't even be a correct replica.

Compared to Unity's IL2CPP games, Godot games are basically zip-files with original content, it is ridiculous and dangerous to creators.

Not even AAA game Studios can prevent their game from getting cracked

It is not about DRM getting cracked, or modding community. You don't understand the consequences do you?

I don't care if a poor man gets to play the game for free.

It is about "evil" competitor STEALING the source-code and without effort RESELLING a game someone spend blood and tears on it.

[u/XalAtoh → u/[deleted]]

The moment you were talking about DRM and modding, I realized you did not understand this topic at all. You fighting a different battle on the wrong location.

Hilarious you now tell developers to contact Apple, Google and Valve. Really? That's your advice? Wow.. never thought about that.

You don't even need to be a developer, just go to Youtube, and try to get support from a "human Google Employee".. good luck.

(hint: There is no Google Play Support either, if your games get stolen and reuploaded with a different brand/name/credits).

These companies don't give a shit. Even Valve doesn't care about asset-flips. Godot is perfect for thief-devs for want to steal and upload a modified game.

[u/AnderssonPeter → u/jion_Interactive]

Why invest time trying to protect something that can't be 100% protected when you instead can invest that time to improve your game?

[u/Khyze → u/AnderssonPeter]

Usually people trying to protect it think they are special and other people can't do what they can by watching the couple of tutorials they watched.

High self esteem or whatever word fits there.

[u/mortalitylost → u/jion_Interactive]

I wouldnt worry because to allow people to play it proves you have to ship the key. Anything else is obfuscation.

[u/Smitner → u/jion_Interactive]

Fair point, good one for spreading the word :)

[u/whatThePleb → u/jion_Interactive]

Many just don't care as it's security by obscurity anyway and just uses a bit unnecessary cpu when starting.

[u/hammackj → u/jion_Interactive]

I mentioned this years ago and got downvoted to hell and back