Printable View
Hi,
I just wanted to make it known that app's data files are easily accessible even on un-jailbroken iOS devices.
Often all you have to do is modify a value in the ini file to give yourself the in-app purchases for free.
The only way to protect yourself from such modifications is to employ some sort of protection. Have the app detect modified files in some way and disable in-game features to combat hackers.
The only way is if there is a way to encrypt the ini files on a IOS device. I know INI++ does this on windows but not IOS.
Just have to face the fact there are always going to be people that hack/get your game for free.
There is another way to protect the data, and it's the way I'm currently doing it.
Just use the string parser object to create a hash of all your save data and save that in the ini also.
During startup load all the data into memory then check to make sure the hash is correct. If it isn't you can either reset the save file or disable certain features.
Adding this to "pocket ninjas" would be trivial since there isn't that much data being stored.
just use an array file, much harder to know what does what.
Yeah that would work too. At least for your basic script kiddy.
A couple points, the vast majority of users don't know how to do this or just dont this so Im not sure how much of an effect it really has on sales. im sure there's some, but Im not sure how dramatic it really is.
You'd be surprised what most users can do. In fact I was talking to some people last night who play that game "clash of the clans." after modifying some data files to change the price of some in-game items and trying to buy them. The game detected it since it uses a hash mothod of verifying the files with the server, and so he ended up paying for it instead.
I guess it depends on how popular your game is, and how much it's worth to you.
I think UrbanMonk's point is a valid one here, so some time this week I'll maybe throw a couple of suggestion MFA's up where you can utilise the regular INI object to kind of encrypt your INI's with things like the tokenizer and string parser. It will help for future developments. In the meantime, if anyone else has any idea's, please feel free to share them with the community.
Sounds good!
I absolutely want to use some sort of encryption for our forthcoming game as well. This game isn't going to be easy to "win" and there will be temptation to cheat, I'm certain of it. I was under the impression that the blowfish encryption worked on IOS, and now I know I was wrong about that, so I'm exploring ways to slow down hack attempts too.
We discussed this a bit a the big meeting last week and I might try to port the hashing object to the iOS runtime. Hashing can be great for checking if data has been tampered with.
I posted an example file somewhere in these forums a few weeks ago that made a simple checksum from the user's score so that it couldn't be easily tampered with.
Securing the data properly with a cryptographicly secure hash is the best way though.
That would be great, thanks!
Is it possible to make the game save files which are ready only outside of the game exe and require a password, or something? most things like that scare off the script kiddies.
Remember once you introduce encryption it affects export depending on the method when you distribute it. I would also argue that your target audience will always find a way around anything you do. Embrace people using your apps for free as it is a reality. You never know when a no sale will come back as a sale if you've demonstrated value.
Encryption is the wrong word here. More like a method of detecting tampering.
I honestly don't care if a user changes some data, like unlocked levels or something similar. When it becomes a problem is when they're unlocking things that should be bought. Trust me. If the user wants something bad and hacking doesn't work they'll buy it.
If the user is just playing around for fun and wouldn't have bought it anyway then it doesn't matter.
It is incredibly easy to change save data as it stands. Not just with MMF games either.
I'm fairly confident in my save protection as it stands. I'm using the String Parser 2 object's md5 hash to pull it off.
It doesn't block the user from cheating. It just detects the cheat and prevents them from submitting scores and using IAP content. (only if they haven't bought it of course)
I have recently noticed on the iOS Provisioning Portal that App IDs could be enabled for Data Protection. I couldn't find any official information about what that is. But I found this on Google: https://github.com/phonegap/phonegap...tform-Security
So I wonder if the crypto engine mentioned in this document could be used by us (I mean Clickteam) to perform data encryption on device.