encryption script

Started by Memor-X, December 21, 2010, 06:40:16 pm

Previous topic - Next topic

Memor-X

does anyone know of a script that can encrypt the data and graphic files as separate files instead of the huge compile file made by RMXP cause i just compiled my game and it's like 160 MB, 110+ MB of it is the compile file itself, and i want to create an update for my game that will fix the bugs that are still in it because the first version of the game i'm putting out is the one i got an honorable mention for in a comp so i want people to see what stage it was at when i got that mention and the patch will fix up alot of the bugs showing how much it's improved and i don't want to have people download 100+ MB for a patch (that and it'll take hours for my computer to upload it to my webserver)

really would like the help

ForeverZer0

Don't use RMXP, or bother encrypting, that is basically the only solutions. You can then simply have them re-download patches to be added to Scripts.rxdata, or send new graphics to there respective folders. This obviously will leave them free to all to see and steal. You can make an encryption method to encrypt the data first, but RMXP still needs to decrypt it to read it.

Ruby is way too open source to use a full-proof encryption method. I have yet to encounter one that I could not crack. Re-packing your DLL with a different encryption key with a different packager is about as good as you can get. Creating a full-proof encryption is pretty easy, I made one, but it requires a "key" or password. Problem is the system also needs the key to read and execute the scripts, which make it vulnerable for someone to find and exploit.



I am done scripting for RMXP. I will likely not offer support for even my own scripts anymore, but feel free to ask on the forum, there are plenty of other talented scripters that can help you.

WhiteRose

Quote from: ForeverZer0 on December 21, 2010, 07:44:16 pm
way too open source


Haha, that's something I've never heard before. Truth, though.

Memor-X

@ForeverZer0: yeh, reason why i want some sort of encryption, my friend who is helping me work on Nexis Core: Chain of Shadows is a bit touchy in people going though our work, reason why i had to agree that if i get beta testers for our game they can't get a raw copy of the game or get the Pandora Trophies

do you mind if i can get a copy of the encryption you made? kinda interested in seeing how it works and see if my friend's one-way key generation program (used to create a unique HEX key every time another key was used) could work with it, we mainly just use it to generate HEX WEP Keys

ForeverZer0

I'll see if I can find it. I based it loosely off the DES. It uses a password, whose characters are converted numbers, then shifts the bits on each byte, but each shift is altered by the number of bits shifted on the previous byte. I never released it yet, and likely will not until I figure a way to keep the encryption key completely hidden from the user. This is the fundamental problem again.

If your friend is really serious about keeping his work from prying eyes, he's better off not to use a Ruby platform. I personally don't care either way. Anybody who wants to look at my code that bad can.

The more I got into writing an encryption method, the more I realized how futile it is. You will never completely protect it using any sort of Ruby code. At some point the system has to read the data, and this is the point at which it will be cracked.

The way I look at it, you can come up with a good method, which will prevent casual "hackers", although cracking a Ruby code is hardly "hacking". Just realize that anybody who does "crack" your method, likely is not going to do anything with your code. They're doing it just to to do it and test their own capabilities. If they can hack your code, there is probably no scripts that were written that they couldn't do themselves.

In the end, any method you use will merely be used to protect against people from simply using a program like DRGSS or something to decrypt it, not anybody who actually has a clue what they are doing.
I am done scripting for RMXP. I will likely not offer support for even my own scripts anymore, but feel free to ask on the forum, there are plenty of other talented scripters that can help you.

Blizzard

Technically everything can be cracked. It is only a question of time. The only method that is actually proof to cracking is when you encrypt data with a strong asymmetric encryption where the key for decryption is not available to the cracker. Whenever somebody has the executable on their PC, they do have the decryption key available. And the only reason why it is "proof" to cracking is because the time it requires to be cracked is relatively high. You gain nothing if need a 10 years to you decrypt a message
Check out our game brands:

Daygames
Game Night Games
Chugnar Games

Quote from: winkioI do not speak to bricks, either as individuals or in wall form.

Quote from: Barney StinsonWhen I get sad, I stop being sad and be awesome instead. True story.

ForeverZer0

Totally agree with Blizz.
Although using a differetn language, such as C or C++ will greatly reduce the odds of it being cracked, since most in the community are more familiar with Ruby. Ruby is utterly useless when trying to create an encryption method.
I am done scripting for RMXP. I will likely not offer support for even my own scripts anymore, but feel free to ask on the forum, there are plenty of other talented scripters that can help you.

Blizzard

I concur. The only way to create an effective encryption in RMXP is having an external tool such as a DLL that is called from an altered Game.exe. Even that can be cracked, but you have to be quite an experienced programmer and cracker to be able to do it. Half-assed RMXP scripters won't stand a chance.
Check out our game brands:

Daygames
Game Night Games
Chugnar Games

Quote from: winkioI do not speak to bricks, either as individuals or in wall form.

Quote from: Barney StinsonWhen I get sad, I stop being sad and be awesome instead. True story.

Memor-X

@ForeverZero: actually my friend's a girl and a talented hacker, she helps me by being my second pair of eyes since from experience, a programmer can't debug his code on his own and need another pair of eyes to find the mistakes you've missed, she just doesn't like people taking our stuff because she think that if they do they won't credit us, and she doesn't use Ruby, her key gen program was built in game maker, c++, VB and C# (she made it for all 4 platform just to prove that only the syntax that change, nothing else, lead to her making a script changer program which changes the code for the pages of code use in the key gen program to another platform), when you find it, tell me where i can get it. it's probably not because the community knows Ruby but the fact that you don't normally see 2 or more languages used to program something unless it's a web page

@Blizzard: to true, no matter the security it will be cracked, you just need to make the hacker work hard and get them to give up. i don't even know how to make a .dll (been trying to find out how to create an SQL Library for Game maker) or mod the .exe file (apart from changing it's icon)

thanks for the help, just wonder though is there a way to get a second compile file to append the first on start up?, i know that RPG maker reads the file like a whole directory tree from what i've read in scripts, something like a script that does some sort of polymorphisum for the compile files (so anything in the most recent compile file is used over it's duplicates in the older ones), i know that kinda seems off topic but i made this request hoping i could reduce the size of a patch

ForeverZer0

December 23, 2010, 12:26:43 pm #9 Last Edit: December 23, 2010, 12:27:46 pm by ForeverZer0
If you already have a good encryption method, have your scripts saved in encrypted files externally, and the user merely has to re-upload the updated script and replace the old one, or even just have it done automatically.

As for the keygen, if you are still using the either the default Game.exe or RGSS102E.dll (or any of them), it can still be cracked easily with a Hex-Editor. I actually found a relatively easy way to find encryption keys in the dll, even when it has been altered and re-packaged, or at least cut it down to 256 possibilities (the last 4 byte group can sometimes be a bitch to find, depending on how it was repackaged).

Doing all this will stop the casual hacker, who doesn't really know what there doing but simply following other's directions. I imagine this is your target group you would like not to let see your work. I look at other's projects all the time who attempted some type of fancy encryption that took all of 2 minutes to break, once I discovered the common patterns. I never stole anything, I merely glanced over there scripts out of curiosity, and I was done. I don't go and tell everyone how to do it. I even contacted a person once personally to let them know its weakness, but was replied to negatively, so I won't even do that anymore.

Point is this: If you want to make a game that will be very hard for hackers to crack, build your own Game.exe and DLL. Doing all that kinda defeats the purpose of using RMXP, though.
I am done scripting for RMXP. I will likely not offer support for even my own scripts anymore, but feel free to ask on the forum, there are plenty of other talented scripters that can help you.

Memor-X

yeh, though i only plan to build Nexis Core: Chain of Shadows in RMXP, the other 3 games in the Nexis Paradigm Series (an other games in the Core Series) i want to build in Unity, problem is that i don't have the graphic skills to make any resources for Unity, all my graphics in Nexis Core: Chain of Shadows are edits of the RTP along with a few community tile sets

ForeverZer0

Either way, I wouldn't worry to much about people stealing your scripts. No one is actually making money using RMXP, and if you thought the scripts were that good, get a license or copyright to protect your work. Then you can sue them for trillions.
I am done scripting for RMXP. I will likely not offer support for even my own scripts anymore, but feel free to ask on the forum, there are plenty of other talented scripters that can help you.

Memor-X

me game is also for my portfolio for getting into the game industry, the only way i can prove i did create the game is having all the resources in raw format (since i use an alias on the net, not my real name) since apart from work experienced you can get in if you have a shipped game (or a game that is available for download), not overly worried about the scripts being stolen, only about 3 are my own work, one of those is just like Sephs Sphere Grid yet i rely on using the self switches on events so the system is only compatible with 4 characters

Zeriab

Here's a good encryption system :V
def encrypt(filename)
if FileTest.exist?(filename)
   File.open(filename + '.enc', 'wb') {|file| file.print '.'}
end
end


Oh, you also want to be able to decrypt it again? Well... don't use that then >_>


More seriously the problem here is not protecting data from a man-in-the-middle, but rather the tougher problem of allowing the game to use the resources while they are unavailable for the player in other contexts.
What can you do to prevent a hacker using the decryption system provided by the game to decrypt the resources? (Not considering malware as an option)

What you really want is to protect your work.
You already got the copyright since that happens automatically. If possible in your jurisdiction actually registering the copyright will be beneficial. Not just in legal issues, but also as a matter of verifying that you are indeed one of the authors for employers.
The default encryption system however easy it may be to break still sends a clear signal. I haven't heard of any cases where anyone accidentally decrypted the .rgssad and extracted its contents into a file structure.
You can provide clauses in the eula which prevents the end user from decrypting the .rgssad in any other context than what the unmodified game does. You cannot completely forbid decryption of the encrypted archive in the eula because the end user wouldn't be able to play the game otherwise. It will probably be a bit tricky to formulate the eula so that decryption is only allow in the smallest extent required to play the game.
Yes, this is about letting the legal system handle the shortcomings of the technical solution.

When the game is finished I suggest that you create a production version where you have only what's needed and nothing more. Where you also remove all comments in your scripts and all unneeded comments in the events. (Some event comments may be necessary for some script system. By default no event comments are needed)
It is important that you keep a version which contains the extra information and also keep other resources you used to create the game, but which is not needed in the production version.
Hackers can't extract information from the game which is not present. They can of course try to recreate it, but keeping this extra information will definitely help.

Quote from: ForeverZer0 on December 23, 2010, 06:10:57 pm
Either way, I wouldn't worry to much about people stealing your scripts. No one is actually making money using RMXP, and if you thought the scripts were that good, get a license or copyright to protect your work. Then you can sue them for trillions.

There are people making money using RMXP and I think there are actually a select few who make a living creating commercial RMXP games.


As for the patching question you can modify the following snippet for .rxdata files (except Scripts.rxdata):
alias patch_load_data load_data unless $@

def load_data(filename)
  # Check if a patched file exists
  if FileTest.exist?(filename)
    data = ''
    # Read the contents of the file (binary mode)
    File.open(filename, "rb") {|file| data = file.read}
    # Try to decrypt and load the data
    begin
      object = Marshal.load(Decrypt::decrypt(data))
    rescue
      # Malformed file, load from the encrypted archive
      return patch_load_data(filename)
    end
    # Return the object
    return object
  else
    # Load from the encrypt archive
    return patch_load_data(filename)
  end
end

module Decrypt
  def self.decrypt(data)
    # Fill this out
  end
end


You need to fill out the decryption yourself which should correspond to however you encrypt the files.
You can do something similar if you want to update Scripts.rxdata: (Must be placed in the first section, i.e. as the very first script)
module Decrypt
  def self.decrypt(data)
    # Fill this out
  end
end

if FileTest.exist?('Data/Scripts.rxdata')
  data = ''
  # Read the contents of the file (binary mode)
  File.open('Data/Scripts.rxdata', 'rb') {|file| data = file.read}
  # Decompress and load the object
  begin
    scripts = Marshal.load(Decrypt::decrypt(data))
    # Remove the first script (This script)
    scripts.shift
    # Decompress and evaluate the scripts
    for tuple in scripts
      script = Zlib::Inflate.inflate(tuple[2])
      eval(script)
    end
    # Exit the game
    exit
  rescue
    # Malformed file => Do nothing
  end
end


The scripts.shift line is only necessary if the script is also present in the patched version.
I included the Decrypt module in both snippets in case you just chose one.

*hugs*

Memor-X

thanks Zeriab, just got all the changes files and that from my friend, so i'll be testing out what you've given me, the only scripts that have comments are the community scripts and the default ones, the scripts i've made don't have any (since i use Windows 7, i use the sticky notes to make notes) as for comments in events, i only use a ---------------------------------- comment to break up chunks of event commands that i just copy and paste

with the patching scripts you've provided, just some questions, say i was using the default encryption of RMXP (if you can call it that), does that mean that the Decrypt Module remains empty?

also, the script you provided for encrypting, how does it do it? all i see (based off my limited knowledge of rgss) is that it opens and file and prints the file, it doesn't seem to do any sort of changing

Zeriab

You'll have to fill out the Decrypt module for it to work. I have not provided any method doing that, just the framework around it.
The encryption is for the patch files which will reside outside the encrypted archive in the normal directory structure.
You can choose not to have encrypted files and just return data, but then people can just copy those files over to a rmxp project and look into them.

I haven't provided any means for actually encrypting data files so what I have provided is by no means a finished solution.

*hugs*

G_G

Whether you make your own encryption system or not, I found this nifty tool called Patch Maker by Clickteam. When you're game or demo is finished, you'll want to duplicate that folder. Unfortunately its not free. HOWEVER!!!! There is a free version, the only bad thing is theres an advertisement linking to their website. Which isn't bad at all. Its worth the small patch files and stuff.

Full Game (First Release)
Full Game (Update 1)

Run patch maker, choose your first release folder, then choose the update folder and it'll compress it all into one executable as a patcher. I haven't really messed with the program but I'm pretty sure once you make an update 2, you'll want to choose Update 1 as the old folder. Because if people have update 1 installed and you choose first release as the old folder, it'll check the files to basically see if the current files match the old folder compressed into the executable. If they don't it can't patch it. But you can make multiple patches.

Game 1.0
Update 1.0 to 1.1
Update 1.1 to 1.2
Update 1.0 to 1.2

Heres the link to the patch maker http://www.clickteam.com/website/usa/patch-maker.html

Blizzard

As far as I know, lots of people have tried doing exactly that using Clickteam's installer. You know what happened? Patching a game would corrupt the RGSSAD archive. So I'm not sure how safe it really is.

I, personally, have used NSIS and I'm satisfied with the results. The only downside with NSIS was that I had to learn the script language for the install creator and organize everything in the registry in order to be able to make it all work. But once I had it all working, it was fine. If I want to make a patch now, I just copy paste the script, change the file listing inside the script, change the versions inside the script and run it.
Check out our game brands:

Daygames
Game Night Games
Chugnar Games

Quote from: winkioI do not speak to bricks, either as individuals or in wall form.

Quote from: Barney StinsonWhen I get sad, I stop being sad and be awesome instead. True story.

G_G

I had no idea about the corrupt thing. INSIS sounds interesting. Imma check it out :O

Blizzard

I think I could actually post up my scripts. O_o That would make it so much easier for people to create installations and patches.
Check out our game brands:

Daygames
Game Night Games
Chugnar Games

Quote from: winkioI do not speak to bricks, either as individuals or in wall form.

Quote from: Barney StinsonWhen I get sad, I stop being sad and be awesome instead. True story.