Sometimes I can't play a paid Android platform game because it requires an internet connection, and I'm in a place where 3G doesn't work.

Here is my understanding so far:

  • The game is a "good old platformer" which wouldn't normally require any network (no online features for the main solo story)
  • Because the publisher can't control the hardware (Android, iOS), they achieve anti-piracy by requiring an internet connection when launching the game and before each level.

My question is: how can they achieve to "obfuscate" the app enough to decrease the likelihood of piracy, where thousands of players would play the full game without purchasing? Is it extremely difficult for a hacker to record the successive states (memory snapshots) of the game when playing the full version, and recombine them in a pirate app that would skip the network traffic?

I understand that the anti-piracy internet requirement is part of a legit business model, and I'm still scratching my head about how this can be implemented and enforced in practice, and how I could do the same "from scratch".

  • \$\begingroup\$ Please note that our help centre cautions against asking questions that are "a rant in disguise" — and this seems to be headed in that direction. Are you interested in implementing anti-cheat/anti-piracy measures in your own game (this we can help you with), or are you seeking to vent or justify frustration with an existing game (for this, gaming social media is more than sufficient)? I think you'll get better answers if you edit your question to minimize call-outs of a particular game or speculation about its developers' intentions. \$\endgroup\$ – DMGregory May 27 '20 at 11:37
  • \$\begingroup\$ Thanks for the guidance. To clarify: I'm genuinely curious about how this works at all (especially if crypto is involved). The StackExchange Game Dev forum seemed like an appropriate place for the question, though other communities may qualify. The info I provided is not speculation, it comes from a proper interview of a Nintendo manager involved in the game. I am not planning to pirate games, and I'm not going to implement anti-piracy myself right now. It is however important for me to better understand client-server interactions on "untrusted" devices. \$\endgroup\$ – Deleplace May 27 '20 at 11:53
  • \$\begingroup\$ The trouble is that the only folks who can tell you how the internet connection requirement is used in Mario Run are the developers of Mario Run. We can suggest to you ways that you can implement anti-cheat/anti-piracy measures in your own game, but we can't speak on behalf of the devs of a particular game. So, we generally consider "How does game X achieve Y?" questions off-topic here. If you can reframe this into a question about an original game or mod that you are hypothetically developing, then it can be asked here. It it's not about that, then it does not belong on a gamedev help site. \$\endgroup\$ – DMGregory May 27 '20 at 12:07
  • \$\begingroup\$ @DMGregory I think I can rephrase to make the question more general and not about a specific game \$\endgroup\$ – Deleplace May 27 '20 at 12:17

I don't know how the DRM of this particular game works, because I do not work at Nintendo. But a common reason why DRM requires an always-on internet connection is because not every copy of the game is the same. Everyone who buys the game gets a copy with a different license key. While the player is playing the game, the license key is sent to the server. When a second player comes online with the exact same license key, then one of them is obviously playing a copy they didn't buy.

When the game is bought through a store platform which assigns unique IDs to users or devices, you can also use an internet connection to verify purchase. The game sends the user/device ID to the server, and the server verifies that this user/device has actually bought that game.

As with every DRM scheme, this system is not bulletproof. No DRM scheme is bulletproof. When a game runs on the user's hardware, it's in the hands of the enemy. A determined hacker can find out where the game stores the license key and how to replace it with a different one. Or alternatively change the game executable so it will run without comparing the license key. But that takes some time to figure out. Most games make their most revenue during the first weeks after release. So the idea is not to deter the software pirates forever, but only until the launch weeks are over.

  • \$\begingroup\$ The "delay piracy by a few weeks" is very insightful and makes a lot of sense, thank you! I was expecting the DRM to be more sophisticated than just "check the license key", something like "cipher all the levels at rest, and ask the server its permission (a one-off decipher key) before playing a level, and then cipher it again". \$\endgroup\$ – Deleplace May 27 '20 at 12:10
  • \$\begingroup\$ @Deleplace I actually glossed over a lot of implementation details. Some DRM schemes actually do verify individual files constantly and exchange their checksums with a server to detect tampering. Denuvo, for example, a well-known DRM solution for PC games, is well known for that. But as I said, I am not familiar with the DRM scheme of this particular game. \$\endgroup\$ – Philipp May 27 '20 at 12:12
  • \$\begingroup\$ @Deleplace you can do one better in something like a runner game where the levels are so simple and compressible: put the levels or the level generator on the server, so you need to request the very ground you tread, and a hacker would need to spend a lot of time recording valid levels to play offline - especially if the server enforces limits on how often a new level can be requested so they can't be batch-downloaded. \$\endgroup\$ – DMGregory May 27 '20 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.