How can I protect my save data from casual hacking?

Question

What options are there for saving game data in a secure manner? I'm interested in solutions specifically tailored for C++.

I'm looking for something that is fast and easy to use. I'm only concerned about storing simple information such as

• Which levels are and are not unlocked

• The user's score for each level

I'm curious again to know what's out there to use, any good libraries to use that give me nice, secure game data files that the average player can't mess with.

I just found this here which looks very nice, but it would be great to get some opinions on potential other libraries/options out there.

Answer 1

first lets say since you have a very simple save file, you can use text file.

one of the simplest ideas is to use a string key to lock/unlock data:

void encrypt(string& data,string key)
{
    for(unsigned i=0;i<data.size();i++)
        data[i] += key[i%key.size()];
}

void decrypt(string& data,string key)
{
    for(unsigned i=0;i<data.size();i++)
        data[i] -= key[i%key.size()];
}

but after a little google search I've found these links, which might be useful:

• https://stackoverflow.com/questions/2155678/decrypt-file-in-c-with-microsoft-crypt-api-that-was-encrypted-with-tripledes-i
• http://www.cryptopp.com/

Edit:

Based on signed char being "Undefined behavior" as @v.oddou mentioned, I guess using XOR or casting to unsigned char will result in safer/more-cross-platform code. something like this:

void encrypt(string& data,string key)
{
    for(unsigned i=0;i<data.size();i++)
        data[i] ^= key[i%key.size()];
}

void decrypt(string& data,string key)
{
    for(unsigned i=0;i<data.size();i++)
        data[i] ^= key[i%key.size()];
}

Answer 2

Nothing can be considered secure client side; anyone who tells you it is, is lying.

You can use any encryption and scramble method you want, but since the client must be also able to decode it, and the user has access to the client itself, if he is resourceful enough he'll have access to the decryption key / algorithm.

You can only add layers of annoyances to someone willing to crack it, but given enough time it will be cracked, and you can't do anything about that.

Answer 3

You can definitely leave your save file unencrypted but add a checksum that is calculated through all the values that you want to "guard".

The cracker would therefore be able to re-produce the hashing (which you off course will use with proper salt) and therefor will have a happy time trying to re-produce.

This would still not be %100 secure but, probably the best time effective solution.

Answer 4

This provided some simple XOR encryption:

#include <iostream>

using namespace std;

string encryptDecrypt(string toEncrypt) {
    char key[3] = {'K', 'C', 'Q'}; //Any chars will work
    string output = toEncrypt;

    for (int i = 0; i < toEncrypt.size(); i++)
        output[i] = toEncrypt[i] ^ key[i % (sizeof(key) / sizeof(char))];

    return output;
}

And how to use it:

int main(int argc, const char * argv[])
{
    string encrypted = encryptDecrypt("kylewbanks.com");
    cout << "Encrypted:" << encrypted << "\n";

    string decrypted = encryptDecrypt(encrypted);
    cout << "Decrypted:" << decrypted << "\n";

    return 0;
}

The output of this code is this:

Encrypted: :=.43*-:8m2$.
Decrypted:kylewbanks.com