AssetManager and encrypted graphics

caseyryan

Hi!
I'm looking for the best way to protect graphic asssets of the game. As you all know, if we just use AssetManager to load graphics asynchronously they need to be stored in the open form, so anyone who has the apk file can unzip it and get access to all assets. So I need to protect them somehow. Storing them in SWF is not a good idea at all. I still need so load everything asynchronously and have several graphic packs.
The good idea would be to have some method in AssetManager class, which would load and decrypt assets on the fly using some key
Maybe someone has a better idea?
How do you solve this problem?

henke37

I wouldn't even bother. Whatever encryption you can invent yourself is going to be crap. And there is still the obvious problem of the client having the decryption key AND decryption logic.

caseyryan

It doesn't matter. I can hide this key. Yeah, it will be possible to hack this, but it will be much more diffucult (especially for not very qualified "hackers") than simply unziping the apk file.
Most games have their graphics hidden, I've checked it by unzipping some other people's apk files

sHTiF

I doubt most games have graphics hidden, almost all games I checked they are either right there or just zipped. But they are not in APK since most games download assets additionaly later.

caseyryan

I doubt most games have graphics hidden, almost all games I checked they are either right there or just zipped.

How many games have you checked?
I've downloaded several arbitrary apk's of popular games written in as3 and all of them have graphics protected.
For example Disney's "Swampy Crocodile: where's my water?", has graphics in .waltex format. I'm pretty sure it's normal png files because it has xml description which contains original paths with .png extensions, but winhex shows no headers of these files, so I'm pretty sure they were encrypted somehow, probably with hurlant library.

Anyways, since I had't found any built-in solution, I've modified starling's AssetManager and added my own extension recognition to it. So now, if it finds a file with this extension, it feed its bytes to a decrypt() method prior to loading them, and decrypts the files using predefined AES key. I think it would be good if staling had a built in solution for this

Jeff

I think it would be good if sta[r]ling had a built in solution for this

Did you look at the docs for AssetManager? I think you should be able to use the protected function transformData for this purpose quite cleanly in a subclass:
https://github.com/Gamua/Starling-Framework/pull/514

henke37

It is normal to leave paths of files not used in. Assuming that the data is encrypted just because you can't find a specific signature is a bad idea.

caseyryan

Jeff, hah, yeah, I did, but I must have missed it. Thank you very much)
But anyway, there's still a little drawback with it, is the extension. The file most probably won't have png or jpg or other typical extension, it will have custom one, so asset manager will process it as bytearray. But I want it to be processed as usually to have getTexture(), getSound() and other AssetManager's methods working normally

Assuming that the data is encrypted just because you can't find a specific signature is a bad idea.

I am not assuming it because of this. You can check it yourself if you want http://www.apk4fun.com/share/6695/ Simply download the apk and unzip it to see what I mean.
p.s. Not for the purpose of piracy or any other stuff like that. It's just for the science 🙂

Daniel

Mhm, that's the downside of 'transformData'.

I've got a few open issues to make the AssetManager easier to extend — I'll do that eventually, but it will take a little time before I get to it. In the meantime, a custom modification (copy of the whole class) is the easiest way to go. Then you can just paste your custom file extension into it.

user23915732

Hi, I am also interested in hiding/encrypting my game assets by overriding the transformData method as described above. However, I am new to encryption and I would like to know a simple way to encrypt/decrypt the byte data loaded from the file. I'm not using any custom file extensions (just .jpg, .png, .mp3) so a modification of the whole asset class is not necessary. I've also looked into as3crypto, but I need something more lightweight and fast for a mobile cpu.

Thanks.

Daniel

A very simply algorithm would be a XOR encryption. I don't have any source code right now, but all you need to do is make a binary "XOR" operation for every byte in the ByteArray. Encryption and decryption is just the same method repeated again.

Not terribly secure, but fast and easy to implement (and probably sufficient for your needs).

henke37

By "not terribly secure", he means that an attacker can usually guess the keystream by guessing the plaintext contents. In fact, if the plaintext contents is a sequence of zeroes, then the keystream is revealed. You need a keystream of equal length to the plaintext to make xor secure.