encryption script

[G_G]

Yes please! NSIS is confusing me already D: Fail

[Futendra]

Well, you always have those nuts people who spend 30 years trying to crack the USA National Bank...

[Memor-X]

i don't think patches will work the way people here think they will, reason why i asked for a different Encryption for RGSS

Patching is when you add/edit/remove files, with RPG Maker XP games, unless it's music, all your other files are encrypted into the RGSS Archive, a single file, make a slight change to graphics or fix up a bug in A map, your recompile that archive and put that up for download, it's not a patch, it a re release in a sense since the RGSS Achive can become far larger than the music folder it self (especially if you use DREAM for Music)

the only way to really patch without changing the encryption is to what Zeriab put up which changes the files in the archive but you need to know the encryption for that first

Probably Blizzard is the only one who's got an encryption system which allows his data to be outside that archive and be safe from editing (to a point)

[ForeverZer0]

What exactly are you looking for?
If you want an "encryption script", as in a Ruby script, you need to forget about it. I challenge you to make an encryption script written in Ruby that can't be broken in less than 2 minutes.

At some point in your script there will be an "eval". That is all you need to find to crack it all open. Thats Ruby. It doesn't even matter if you have the absolute, toughest, son-of-a-bitch encryption this planet has ever seen, somewhere you are going to have to use it to have the Ruby interpreter parse the code. At the point the code is put in the system, any idiot with a any knowledge of Ruby can break it from there. Even afterwards, you can still get the code thatsl loaded in the system.

You need to create a .dll and a new Game.exe, written in C or C++. That will reduce the chances of a crack. There is no sure proof way to do it. If there was, none of us would have half the cool software that we do. 

[Memor-X]

an alternate encryption which has all the files in at least the data folder separate instead of a single archive, my game at the moment has a 110+ MB archive and i don't think people will keep downloading that for every patch, considering i only plan 2 patches (one to fix up bugs that was in my comp entry and one to make the game compatible with Pandora) but when i get down to the final release an I've gotten people to test the game, i don't want people to be downloading huge archive if it's only a fix which should only be worth a few KB

[ForeverZer0]

You need to create a .dll and a new Game.exe, written in C or C++.

[Zeriab]

I could implement a public key cryptographic system.
Good luck cracking that in a few minutes assuming you don't have the secret key of whoever you are sending the encrypted data to.
Doesn't really matter whether you have the code or have to get it first by either decrypting the standard encryption or reading it from the memory.
Yeah, I know. Such a system is not really applicable in this case unless you want to make sure that others cannot created and authorize patches for the game.

I would suggest you strongly consider whether really want to bother with such methods that will take a lot of time for you to do which provides very little value for legit users and which may take away value from legit users.
You can do something super simple like the example below and let the normal encryption protect that. After all, people can just decrypt the game.rgssad with readily-available tools and let the game do the encryption for them.

##
# Provides simple in-place encryption and decryption
#
module Decrypt
  KEY = 'password'
  MAX = 10000
  def self.decrypt(data)
    for i in 0...[data.size, MAX].min
      data[i] = (data[i] + KEY[i % KEY.size]) % 256
    end
  end
  def self.encrypt(data)
    for i in 0...[data.size, MAX].min
      data[i] = (data[i] - KEY[i % KEY.size]) % 256
    end
  end
end

The fact that this encryption system is out in the open decreases it's usability. That's why I didn't provide any example in the last post, but decided to do it anyway.
I wouldn't put the Decrypt.encrypt method into the actually game though.

*hugs*

[Memor-X]

i get what key (i think, it's kinda like the key used in the default encryption, not going to say it otherwise people who don't know will know) is but what's max for?

[ForeverZer0]

i get what key (i think, it's kinda like the key used in the default encryption, not going to say it otherwise people who don't know will know) is but what's max for?

Any idiot who ever heard of google can figure all this out in 10 seconds or less if they don't know already. There are even threads on this very forum about it, no need to try and be cryptic about this. DEADCAFE. Oops!  

@zeriab
Your method only works if you WANT the people you are sending it to to know how to decrypt it. You can scramble the data to hell and back easily enough that can only be re-organized with a key that the system doesn't need to know, but the user does. That is a good way to securily transfer data, but not applicable for trying to keep the data secret from the people who are supposed to be using it, like scripts in a game.

[Memor-X]

i get what key (i think, it's kinda like the key used in the default encryption, not going to say it otherwise people who don't know will know) is but what's max for?

Any idiot who ever heard of google can figure all this out in 10 seconds or less if they don't know already. There are even threads on this very forum about it, no need to try and be cryptic about this. DEADCAFE. Oops! 

actually i didn't know about threads on this forum about the key and you do have a point

[ForeverZer0]

I'm not trying to beat a dead horse, but if you are trying to use Ruby to encrypt the data from the end user, give it up. You may save it from a few n00bs, but no one else. Ruby is worthless for what you need. NO MATTER WHAT, the data needs to be translated into readable format at some point for the Ruby interpreter. You need to be able to protect the data to not allow the player to get there, such as an encrypted archive, which will require a different language.

Once again: Give up on using Ruby script for this.
And again: Give up on using Ruby script for this.


One last time just in case you had a doubt: Give up on using Ruby script for this.

[Zeriab]

Why not go further and say: Give up on this unless you want to create malware or hardware for it 
It is of course totally impractically to make hardware for it and I really advise against deliberately putting malware in your game. (If you do I really hope you'll get sued)

That DEADCAFE is the key used for default encryption is something you can extract from the .dll-file together with the decryption algorithm. The game must be able to decrypt the data after all.
To understand my weak encryption system read Polyalphabetic Substitution Cipher where the Vigenere table is 256x256 instead of 26x26.
The MAX constant determines the maximum length that will be encrypted of a file. Decrypting a 1 MB file will probably have taken seconds otherwise. Yes, only the first MAX number of characters will be encrypted if the file has more than MAX number of characters.
Why make a stronger one when an attacker can just decrypted game.rgssad using one of the available tools and use the script to decrypt. You don't have to go through any kind of trouble like ForeverZer0 mentions about reading the memory.

I don't agree that this is worthless because attackers now have to deliberately decrypt the files where before you could just copy+paste.
You can do as ForeverZer0 suggest to make it harder:

You need to create a .dll and a new Game.exe, written in C or C++.

Be practical. Is putting what will surely be a lot of time and effort into that worth the gain? What about the current base and scripts? What now if people inject scripts in the memory? You'd have to make your own engine or switch to another and implement your current features as well as the default base.
You end up spending all your time on this and never really be finished. That is why I show the other technically weak protection which is simple to implement since it does at least provide some protection and legally might help ^_^
Which makes me think that you may want to use an asymmetric-key encryption instead or as a supplement. That way you'll only ship the decryption key with the game while you and you alone have the encryption key. Of course people can figure the encryption key out in a couple years or million of years of computing time depending on the select strength.
The encryption key will be a very strong evidence that you are indeed one of the authors.

@ForeverZer0:
It's not at all good for securing data you'll transfer over an insecure network. Not only is it a weak encryption, it might not encrypt all of the data and there are no measures against tampering or profiling present.

*hugs*

[winkio]

The true way to encrypt your game: write your encryption algorithms in brainfuck

[ForeverZer0]

@zeriab
I wasn't exactly refering to your method of encryption, but the same style.
I meant simply scrambling the data around with a key. Like I said in an earlier post, I wrote one that used a string converted to integers, then used all the numbers to shift the bits of each byte. The remainder was applied to the next byte in line, then iterated again, so on and so forth. This way the system never does know the key, it simply uses the provided string and reverses the process. If the wrong password is used, the data remains a useless mess.

That is a secure method. I could encrypt it, give you the source code for the encryption process, and you will still not be able to decrypt it, short of a brute force attack that attempts every possible combinations of ASCII characters. 

I also stand by the fact that it is worthless. It prevents a simple copy and paste, and that is about it. I've seen many try these methods, so I just write about 6 lines of code and have it output it all to text files. They are simple enough to copy and paste from. So "yes" you may stop someone without any Ruby knowledge whatsoever, put even amateur scripters can get your code.

[Blizzard]

The true way to encrypt your game: write your encryption algorithms in brainfuck

Not really. xD After translation into Assembler code, it becomes readable again. xD

[winkio]

Don't worry everyone, Blizz is just joking, as brainfuck is so awesome that it needs no assembly code.  So by all means, start programming encryption in brainfuck.

[The Niche]

I loved the way they tried to write a formal article on a language called brainfuck.

[Zeriab]

How do you make the game use the encrypted data if it doesn't know the password?
How is the key different from the password in your system?

[ForeverZer0]

How do you make the game use the encrypted data if it doesn't know the password?
How is the key different from the password in your system?

I was referring to you saying it is not a good method for transferring data. Its easy if the reciepint has the decryption method to scramble the data in a totally random way that can be reversed. I'll write and post an example tonight. I'll even give you the encryption/decryption method and see if you can break it without knowing the password.

I haven't created a system for RMXP that the system doesn't know the "password".  That's the whole problem I've been trying to say. It's WAAAAAYYY to easy to get out of Ruby compared to practically any other language. For a game, you are protecting it from the user, not random people in between. Therefore the system HAS to know the encryption key.

[Blizzard]

Actually with asymmetric encryption, the system only has to know the decryption key.