GML Ensure Saved Text File's Integrity

[DesArts]

Hey, sorry for the long winded post for a small issue.

Trying to simply find a nice way to save a file of data which can be shared without being modified. This is for a level editor shareable save file.

The main goal is a file which the contents can be freely read, but the game will know if it's been modified or incorrect.

I save a level locally as a text file using a json_encoded DS map. I will add a 'key' string which is simply defined in the game code and create an MD5 of that entire thing to put at the start in the file.

This way, when the file is saved it has the hash and the file data without the key, so people (and me) can freely look at the data (as it doesn't help me at all to just hide it with encoding) and the game will not load a modified (and by extension, incorrect) file.

[HASH of key+data] [DATA]

The only downside with this is people could find out what the key string is since it's just hardcoded into the game... and what if somehow I lost the key? Is there a smarter way to approach this? Some kind of dynamic key that isn't as obvious? I thought of basing it on the string length somehow, something like that. Or maybe I'm just being a total fool? Pretty much the only issue is the key potentially being easily found. Not earth shatteringly terrible in this case of course, but I would like to be informed if there's a better way to do the key.

This isn't something I've tackled before, clearly.

(btw, I don't use ds_map_secure_save as I hear it will not work when trying to load it on someone else's system. Basically, this should be a shareable file)

Keep in mind this is not for security or sensitive information, simply for ensuring the file's integrity.

Cheers!

 

[DesArts]

should have mentioned -

The stage data is simply a string, and can be shared via either a single text file or just copy/pasteing the string directly into the game. The string is what matters, not it's context as a file.

It may well be that I've basically done all I can in this case. Not sure though, of course.

 

[YellowAfterlife]

See the recent guest post on tech blog https://www.yoyogames.com/blog/537/protect-your-savefiles

 

[bacteriaman]

This thread is a somewhat old, but I just want to add a comment regarding the implementation of the technique described in the aforementioned tech blog article. Even though the article is over two years old, the technique is still very serviceable.

As the article states, the save data is readable as plain text and not obfuscated. However, I found simply wrapping the json_encode function with base64_encode while saving will encrypt the string making it unreadable.

var _save_string = base64_encode(json_encode(save_map));

The same technique is used with loading the data:

load_map = json_decode(base64_decode(_hashless_string));

The other change I made was using a struct instead of a map with json_stringify/json_parse respectively.

This extra step of encryption obviously doesn't make the data any less hackable as described in this thread, but it might discourage the casual hacker.

 

[YellowAfterlife]

As the article states, the save data is readable as plain text and not obfuscated. However, I found simply wrapping the json_encode function with base64_encode while saving will encrypt the string making it unreadable.

base64 is encoding, not encryption. But if you're content with having the absolutely barebones amount of protection that anyone but the most amateur tinkerers can tell apart on a glance, then sure, you can do that.

 

[FrostyCat]

However, I found simply wrapping the json_encode function with base64_encode while saving will encrypt the string making it unreadable.

Not this crap again. Learn the difference between encoding and encryption.

 

[bacteriaman]

base64 is encoding, not encryption. But if you're content with having the absolutely barebones amount of protection that anyone but the most amateur tinkerers can tell apart on a glance, then sure, you can do that.

Yes indeed, that's the only point. Thanks for the confirmation.

 

[bacteriaman]

Not this crap again. Learn the difference between encoding and encryption.

I understand the difference and I qualified that in my post, but your response reminds me of why many people find the Yoyo forums a very hostile and unwelcoming place.