Is your asset worth it?

I've been seeing a lot of big talk in the forums about the fact that asset
protection is futile, etc, as crackers can just do this or that. Usually followed
by some example that the poster probably thinks makes him look like a
l33t cracker.

Look everyone knows its possible to steal assets by ripping from mem,
cracking, etc. What you should be concerned with is what is probable.

You have to choose a level of protection that falls on the appropriate point
on the curve of diminishing returns.

For example one of the simplest things you can do is add a few bytes at the
beginning of image files and just gunk those bytes before reading the stream
with the image libs. Most graphics apps will look at the header stored at the
beginning of a file and if the signature does not match a known header it will
think it is corrupt.

This is sufficient for a large part of your audience as they will try and open the
file and fail and not bother to go further.

Other apps however will scan the whole file looking for a known header and thus the
start of the stream, so if youre concerned about that you add simple encryption
like XOR or what not.

As soon as you get to that level youre moving into an higher level of expertise
required to view the assets, i.e. dev guys. They will have to make a commitment
to crack that asset (which is not THAT much work) but you have to weigh that
against the gains they perceive from having to actually do it.

Finding an unencrypted password in the exe is not that hard, you just dump the string
table and look for it. So if thats an issue for you then you mask or build the password,
(or a ton of other solutions).

Even having the password is not enough as you would have to know which algo was
used, what kind of salting and with what values, etc, then implement that either by using
libraries available or writing your own.

So the law of diminishing returns apply both to you the dev (as you have to do more
and more work to thwart a smaller and smaller probability set) and the cracker/thief
who will have to do the same but based on his perception of value.

For you it is your assets and for a limited product range and so more valuable where
as for the cracker it is a miniscule percentage of assets out there and so of lower value.
Obviously you have to weight this with things like popularity, etc but what asset could
be that valuable; surely you're not storing cc numbers? right?

So if you are going to encrypt at least do it with something like twofish or aes with
custom stream code and salting, etc instead of standard zip as those could just be dumped
out again with publically available zip readers. Encrypt per file and THEN add to zip file system, so
when reading you would stream the asset from the archive, unencrypting as you read it.


~neo