Unity Web Player Threat or Trend?

[NarnMollari45]

For the past 2 years or so I have been seeing a huge influx
of Unity Web Player games.

Does this mean in the future we won't be able to play
them hacked?

Someone please enlighten me on why most game hack sites
can't or won't hack Unity Web Player games?

Cheers

[flashgamehacker]

Unity compared to flash is relatively new, and things that have been around for a long time have a lot more tutorials and tools written for them and people have had the time to experiment and learn new things and tricks on how to hack these from experience

Unity actually is a lot easier to hack than Flash, you can actually decompile back to the original source very easily and change whatever you want. The best protection they can hope for is obfuscation which will only slow down the novice hacker

Flash you can decompile back from compiled P-Code to what is similar to the original actionscript source based on how good the decompiler is

Websites haven't really started hacking Unity yet, partly because some do not know where to start in hacking a Unity game and also because most sites are setup for flash because the flash plugin is what just about everyone has installed and as I said Unity is quite new but is getting bigger

You will probably find the people who will start hacking Unity games are real crackers who actually reverse programs written in .NET (VB.NET & C#) among other languages because they have the experience & tools in converting these back to the original source to find the values to change

I think once someone starts hacking these & maybe sharing some knowledge then you will see a lot more people & sites doing it because flash hackers / developers tend to have different programming knowledge to Java / C# developers

Do not worry though, there is really no reason why Unity can't be hacked, it is just a matter of time until a website is setup to play hacked Unity games

[NarnMollari45]

Thanks Mate!

[ZuckeR]

Yeah, hacking Unity games is actually not that hard. It is a bit different than Flash but there are several methods and tools to do it. I just looked it up and the first successful hack i made was in February 2011. Nothing fancy like key hacks but as a proof of concept. One problem is just that is not so easy to protect hacked games from getting stolen.

[ALPhaKiLLer]

Yeah, hacking Unity games is actually not that hard. It is a bit different than Flash but there are several methods and tools to do it. I just looked it up and the first successful hack i made was in February 2011. Nothing fancy like key hacks but as a proof of concept. One problem is just that is not so easy to protect hacked games from getting stolen.

How about letting only a custom user-agent play the game (controlled by PHP), and when you do play, it opens in an external application (launcher), that, in turn, downloads the game (encrypted HTTPS through launcher) and plays it in the launcher? Then again, time is a factor.

[ZuckeR]

A launcher does not add much if any protection. At some point the Unity plugin will need to load the game to start it so you could easily download it. But it turns out that it is possible to add a sitelock to a game without much hassle.

[ALPhaKiLLer]

How could you add bytecode to a .unity3d application? I don't see any way possible. :/

[ZuckeR]

Unity games are all compiled to .NET assemblies and there are several tools to work with. This even works on every Platform (PC, Web, Android, iOS) because Unity builds up on Mono and the tools often do as well.

[ALPhaKiLLer]

How do you expect to recompile, though? (that is, if you are going to)

[ZuckeR]

There are basically two ways. You could change the bytecode directly with a hex editor or use a decompiler that lets you edit the bytecode.

The first option should always work but limits you as you can not change the file size without breaking it. It works the same way as hacking AS3 games with a hex editor. This lets you change simple things like add ( 0x58 ) to sub ( 0x59 ) but you cannot add bytes.

The second option is much better in terms of possibilities but not all decompilers support that. Usually you have a window with the decompiled CIL bytecode interpreted as C# and one which shows the bytecode line by line. Adding an instruction here is simple but it could sometimes still break the game. There are a lots of decompilers for .NET out there, google is your friend.