Securing WebGL game code

1
votes

As seasoned web developer I understand that javascript code cannot be secure, but only minified/obfuscated.

However, many game engines are confident enough to allow their engine code and the customer's game code to be downloaded and visible in the client/browser.

-

Attempting to understand how Unity3D does it, I came across the following breakdown of the files that are downloaded by the client/browser:

  • A MyProject.asm.framework.unityweb file containing the asm.js runtime and JavaScript plugins.`

  • A MyProject.asm.code.unityweb file containing the asm.js module for your player.

  • A MyProject.asm.memory.unityweb file containing a binary image to initialize the heap memory for your player.

  • A MyProject.data.unityweb file containing the Asset data and Scenes.

Source: https://docs.unity3d.com/Manual/webgl-building.html

-

Then I saw they are using emscripten to compile their C/C++ code to Javascript:

To run in WebGL, all code needs to be JavaScript. We use the emscripten compiler toolchain to cross-compile the Unity runtime code (written in C and C++) into asm.js JavaScript. asm.js is a very optimizable subset of JavaScript which allows JavaScript engines to AOT-compile asm.js code into very efficient native code.

Source: https://docs.unity3d.com/Manual/webgl-gettingstarted.html

-

Questions:

  1. Is it Emscripten and/or asm.js that is securing the Javascript code somehow? How?
  2. Is it even secure? If I try really hard I could "steal" something from this code and write a hack/cheat for a game: https://files.unity3d.com/jonas/AngryBots/Release/AngryBots.js
  3. If I've already written a javascript game, what can I do now to do what Emscripten does for Unity3D games? (assuming #2 is true)
1
javascriptunity3demscriptenasm.jsanti-cheat
1. No,.. 2. No and then Yes. 3. Speed - Keith
So just to be 100% sure, all web based games developed by Unity3D, Godot, Unreal Engine, etc. can be snooped? Shouldn't that be a big concern? @Keith - FanManPro
Any game, even EXE's can be snooped. All you can really ever do is make things harder, because Emscripten it's kind of obfuscated the code anyway it's certainly made it harder. In web technology the best protection is doing some of the stuff Server side, rather than Client. - Keith
@Keith a bit broad but I get what you are saying. With my current JS game, what can I do to obfuscate the code the same way Emscripten does? (without rewriting of course) - FanManPro
I think the code Unity3d etc create should be good enough. Does your game have any secret logic, eg. Say you have some BOT's that are using some secret fantastic AI, rather that having this logic in the Client, make the Server side handle this. Another example, say you had some really cool level generator, again put this in the Server end. Only downside to this of course it forces your game to be Online only, but this is much less a problem than it used to be. - Keith

1 Answers

2
votes

Is it Emscripten and/or asm.js that is securing the Javascript code somehow?

No, those are just part of the toolchain that compiles unity -> webgl code -> javascript

Is it even secure?

No, nothing is secure. If you have a popular game, people will hack it.

If I've already written a javascript game, what can I do now to do what Emscripten does for Unity3D games?

For any games meant to be played in the web browser you should be compiling to WebAssembly that's the standard now, this coming a year after you posted your question. Read more about Unity + Web Assembly

If you're compiling to WebAssembly the binary it exports is difficult to reverse engineer, but not impossible. There are already tools available that can help do that.

At the end of the day, you can't stop client side hacks. Calculate all the important stuff on the server like currency, health etc.., otherwise you have to trust the client with some stuff.