Loading Ogre3D assets from password-protected ZIP files

[skinkairewalker]

I would like to request, within reasonable possibilities, the inclusion of password-protected .zip asset loading (textures, sprites, 3D models, sounds, music, Ogre materials, shaders) in the Ogre3D ecosystem to help prevent asset theft or unauthorized copying.

[Caronte3D]

IMHO:
Don't waste your time, a password protected zip is easy to crack, as always... is better to focus in make a nice game and don't worry about the assets

[Quin]

Agreed, there are just so many attack vectors with zip files, even password-protected ones, from using JTR to crack passwords to breakpointing libzip's zip_set_default_password function to many others. This isn't just theory either, I've done this myself on numerous games.

[skinkairewalker]

But I think it's a bit discouraging that assets are left loose in game files, even for laymen.

[Quin]

But I think it's a bit discouraging that assets are left loose in game files, even for laymen.

Then write your own solution. I'm a reverse engineer and my motto is that you don't have to make it impossible to break, you just have to make it so annoying that I won't want to bother. E.g. give each file its own encryption key derived from a hash of the file, or embed them in an encrypted pack in a datasection so I can't strings it and figure out what pack format you're using. There are many solutions, but a universal solution built-into PB is how a tool to get all game assets from any PB game gets written.

[BarryG]

I think it's a bit discouraging that assets are left loose in game files

You can embed them all into your exe file with IncludeBinary, then Catch() them from it at runtime. No need to have them on disk at all. I do that for my app, which has icons, pngs, wav files, etc. One single exe and nothing written to disk. The assets must have a corresponding Catch() command, though.

[Quin]

You can embed them all into your exe file with IncludeBinary, then Catch() them from it at runtime. No need to have them on disk at all. I do that for my app, which has icons, pngs, wav files, etc. One single exe and nothing written to disk. The assets must have a corresponding Catch() command, though.

I use this method in my app too, but since we now have the amazing CatchPack() command since 6.10, I just opt to pack all my apps data into a BreifLZ pack and IncludeBinary it in a DataSection then CatchPack it. That way I don't need to manually keep track of files. There are lots of options, but like I said previously, I don't think adding this support natively to PB is a good idea, because it would give developers a false sense of security while some people probably already wrote a generic program that can crack any password-protected zip from a PB game like a week after the support got added.

[skinkairewalker]

You can embed them all into your exe file with IncludeBinary, then Catch() them from it at runtime. No need to have them on disk at all. I do that for my app, which has icons, pngs, wav files, etc. One single exe and nothing written to disk. The assets must have a corresponding Catch() command, though.

I use this method in my app too, but since we now have the amazing CatchPack() command since 6.10, I just opt to pack all my apps data into a BreifLZ pack and IncludeBinary it in a DataSection then CatchPack it. That way I don't need to manually keep track of files. There are lots of options, but like I said previously, I don't think adding this support natively to PB is a good idea, because it would give developers a false sense of security while some people probably already wrote a generic program that can crack any password-protected zip from a PB game like a week after the support got added.

I understand, but at least there could be the possibility of using catchMesh(meshdata(), SkeletonData(), MaterialData()) or something along those lines of thinking…

I think it's a bit discouraging that assets are left loose in game files

You can embed them all into your exe file with IncludeBinary, then Catch() them from it at runtime. No need to have them on disk at all. I do that for my app, which has icons, pngs, wav files, etc. One single exe and nothing written to disk. The assets must have a corresponding Catch() command, though.

It would be very interesting if Ogre3D in PureBasic had support for Catch() functions… or added support for other types of compression, as Quin mentioned: BriefLZ and others like LZMA, Jcalg1, Zip, and Tar (and allowing password protection for them).

[skinkairewalker]

There are lots of options, but like I said previously, I don't think adding this support natively to PB is a good idea, because it would give developers a false sense of security while some people probably already wrote a generic program that can crack any password-protected zip from a PB game like a week after the support got added.

But aren’t Zip algorithms currently protected with AES-256? If so, the attack is pretty much null, except in cases of social engineering…
But if PureBasic’s Zip algorithm only supports ZipCrypto, then I would agree!

[Mijikai]

How would this help?
Commonly game hacks hook the renderer and manipulate the models (for ex. see them through walls).
Extracting/logging model and texture data through the render pipeline is not much different.

But having something like #PB_3DArchive_Memory would be very useful in general.

[Quin]

But aren’t Zip algorithms currently protected with AES-256? If so, the attack is pretty much null, except in cases of social engineering…
But if PureBasic’s Zip algorithm only supports ZipCrypto, then I would agree!

Perhaps, but encryption is null and void if I can breakpoint the function where you set the password and inspect the stack.