password protected archives (zip)

[cyrfer]

Hi,
Does the built-in zip archive code have an option to open a password protected file? I'm looking for this feature and it seems like there is no reason not to support it in the built-in zip support.

[Fish]

Ogre uses the zziplib library to provide zip file functionality. zziplib does not support password protection for this reason. The author of zziplib provides an example of how to obfuscate a zip file and how to use zziplib to read an obfuscated zip file. It should be trivial to provide your own obfuscated zip parser/factory to the Ogre::ArchiveManager.

- Fish

[Assaf Raman]

There are two reasons you may want this:
1. You want to hide your resources.
2. You want to make sure that the resources that are used are your resources (if your program downloads files from the internet and such).

1 can never truly be achieved - if a program runs on the computer - you can always decompile it, you can only make things harder - and an idea like the one in the post before mine - is better then a password - that is easier to find with a decompiler.

For 2 you will need to digital signature - to sign with the private key and open with the public key. There are many ways to do this, I don't think that adding a new dependency for OGRE for this need is something we are going to do on the team level, if you really need this feature post here an perhaps someone will create a snippet for you.

[madmarx]

It is (almost) in the wiki :
http://www.ogre3d.org/tikiwiki/Obfuscat ... +Structure

[Fish]

There are still a few small things that I need to add/change before I can consider moving it out of the sandbox (like the toc position and some comments), but it's usable.

Don't spend too much time trying to 'hide' resources. In the end the code will be cracked and the resources will be visible to all eyes. Even the million dollar DRM systems are eventually cracked, sometimes within days of a games release (1, 2, 3, 4). If you are contractually required by a content provider to 'obfuscate' distributed content, then keep it simple: change the .zip extension to something else or do a simple xor.

- Fish

[Wolfmanfx]

You can always dump meshes and materials from the gpu (there are easy to use tools) so do not waste your time with encryption.

[Assaf Raman]

I did need a resource signature checking system in one project - to protect my activex from hackers. I needed to make sure that I created the resources that are downloaded - else a hacker can use my activex to download and run viruses.
Unity3d supports c++ plugins - I don't think they have any way to prevent someone from creating a c++ plugin that copies a virus to computer that runs the unity activex. This is a risk that a simple signature verification can solve.

[jblovloss]

Fish is correct that hackers will get through your password protections. If we're talking about things like textures and models, those will get unzipped at runtime and put directly into memory. Even a script kiddie can get them there.

Maybe there's a nice method for turning your content procedural. If you had procedural code compiled directly into your binary, that would be much much harder for someone to get at. Especially with some code obfuscation.