Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

The reliable approach is defense in depth, not one protection switch. Build the release with Unity IL2CPP when your platform and debugging workflow support it, obfuscate managed names before IL2CPP conversion, verify application authenticity and release-file hashes at controlled points, and enforce purchases, entitlements, competitive results and other valuable decisions on a server. If you distribute through Steam, use its DRM wrapper to verify ownership and deter casual copying, but do not treat it as a complete anti-piracy system.

Every client eventually runs on a player’s device, so a determined attacker can inspect, patch or bypass client checks. Your goal is to increase the cost and time of reverse engineering, detect divergence from your release, protect the online economy and avoid punishing legitimate players when a detector is wrong.

Start with a threat model and a trust boundary

Anti-tamper work is most effective when you decide what you are protecting before choosing a tool. A single-player game that only needs casual copy deterrence has a different requirement from a competitive game whose rankings and trading economy must remain trustworthy.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Define the outcome you need

  • Casual copy deterrence: discourage unmodified copies from being redistributed.
  • Reverse-engineering resistance: make classes, methods and game rules harder to understand.
  • Secret protection: prevent API credentials, signing keys or server-authority logic from being recovered. Anything shipped only in the client should be considered recoverable.
  • Cheat and economy protection: stop modified clients from awarding currency, submitting scores or manipulating trades.
  • Evidence and response: identify suspicious builds without deleting saves or banning a player on one ambiguous signal.

Write these goals down with an acceptable offline experience. For example, you may decide that an altered build can continue local play but cannot submit a leaderboard result. That policy is clearer and safer than attempting to make every feature fail as soon as a check returns an unexpected value.

#1 Best Overall
Sale
Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car
  • Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
  • With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
  • Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
  • Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
  • Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.

Place authority on the server

The client should request or prove the result of a sensitive operation; it should not be the final authority for that result. Keep purchase fulfillment, entitlement state, matchmaking authority, competitive scoring, trade settlement and high-value inventory changes behind authenticated server validation. The server can reject an impossible score, verify that an entitlement belongs to the account and apply an economy transaction once, even if the client has been modified.

Do not embed a production API key, signing secret or administrative endpoint in a Unity assembly and expect obfuscation to make it secret. Obfuscation can hide names and slow analysis, but the device must eventually execute client code and an attacker can observe or alter it.

Choose the Unity build path

Why IL2CPP is normally the release choice

Unity’s IL2CPP pipeline converts managed assemblies into native code. The Anti-Cheat Toolkit (ACTk) manual recommends IL2CPP over Mono for release builds because it removes the straightforward intermediate-IL path and blocks managed assembly injection. This raises the effort required for common managed-code patching techniques.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

IL2CPP is not encryption. Native binaries can still be disassembled, and Unity metadata still contains information that can make classes and methods recoverable. Native debugging and platform-specific build failures can also be more complicated than a Mono workflow. Keep a Mono development configuration if it materially improves iteration, but test the exact IL2CPP configuration that you intend to ship.

Decision checklist before switching

  • Confirm that every target platform and native plugin supports IL2CPP.
  • Verify that your crash-reporting and symbol-retention process works for native builds.
  • Run automated play-through, save/load, networking and upgrade tests on IL2CPP output.
  • Document how developers reproduce a bug using a development build without weakening the release configuration.
  • Keep an unwrapped, debuggable build for local diagnosis; do not use a protected store build as your primary debugging artifact.

Run obfuscation before IL2CPP conversion

A Unity-aware obfuscator should transform the managed project before IL2CPP generates native code and metadata. Renaming classes, methods and fields at that stage means the generated metadata starts with less useful names. ACTk itself does not obfuscate or encrypt managed assemblies; it is a detection and protection toolkit rather than a substitute for an obfuscator.

Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack
  • Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
  • Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
  • Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
  • Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
  • Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth

Build order

  1. Compile the project in a reproducible release configuration.
  2. Apply the obfuscator to the managed assemblies and verify its report.
  3. Run tests that exercise reflection, serialization, save migration, networking and native-plugin calls.
  4. Feed the obfuscated assemblies into the IL2CPP conversion.
  5. Build each platform, retain symbols privately and generate the release manifest used for hash verification.
  6. Run the protected build through functional, compatibility and antivirus testing before store submission.

The exact obfuscator product is a design choice. Unity-focused metadata-protection tools, including tools named in ACTk’s documentation, may add stronger transformations for a higher threat model, but compatibility, current pricing and independent performance benchmarks must be verified for your own Unity version and platforms.

Keep rules are part of the design

Renaming everything is likely to break a Unity game. Create explicit keep rules for symbols that are looked up by name rather than by a compile-time reference:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Types and members accessed through reflection or string-based type lookup.
  • Serialized fields, animator parameters and data referenced by existing save files.
  • Network message names, RPC contracts and any schema shared with a server.
  • Native plugin entry points, callback names and platform bridge methods.
  • Editor-only tooling that must load protected data during development.

Prefer narrowly scoped rules over a blanket exclusion. Keep a machine-readable list of exceptions, review it when a new plugin or save-format version is added, and test an upgrade from an older unprotected save. Obfuscation should be deterministic for a given source revision so that a change in the manifest reflects a real build change rather than random naming.

Add runtime authenticity checks at controlled points

Unity exposes Application.genuine on platforms that support an application-integrity check. It can identify some applications altered after build, but Unity documents the property as resource-intensive. Do not poll it every frame.

Where to check

  1. Check once during startup and record the result with the build identifier.
  2. Check again immediately before a sensitive operation, such as enabling online play or submitting a competitive result.
  3. Optionally check at a small number of other controlled checkpoints, such as returning from a platform purchase flow.
  4. Send the result to your backend when the decision affects an entitlement, score or economy transaction.
if (!Application.genuine) {
    // Record a signal and apply the policy for this build.
    // Do not destroy saves or issue an automatic permanent ban here.
}

The property is client-observable, so a motivated attacker can patch or spoof the branch. Treat it as one signal in a broader decision rather than proof that a player is dishonest. Also distinguish an unsupported platform result from a positive alteration result; an unavailable check should not be interpreted as a failed check.

Rank #3
Sale
BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black | LED mouse pad with 14 lighting modes, covers keyboard & mouse, anti-slip rubber base, waterproof surface, USB powered
  • 【Large size】:Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
  • 【LED backlight mouse pad】:Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
  • 【Anti-slip rubber base】:Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
  • 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
  • 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

Generate and verify release code hashes

Authenticity checks answer one platform-specific question. A code-hash system gives you a release-specific comparison against files you trust.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create a trusted manifest in CI

  1. After the final platform build, enumerate the files that matter to code execution and tamper detection.
  2. Generate a cryptographic hash for each file and store the file-to-hash mapping with the build number, platform, architecture and distribution variant.
  3. Generate a summary hash from a canonical ordering of that mapping. Canonical ordering matters; otherwise identical files can produce different summaries.
  4. Store the manifest in protected build storage and register the summary and per-file values with the backend.
  5. Keep separate manifests for every platform and architecture that can legitimately ship different files.

Verify in the client and on the server

  1. At startup or before a protected operation, calculate the summary hash from the installed files.
  2. If the summary matches the expected value for the platform and build, record a normal result.
  3. If it differs, calculate per-file hashes and compare them with the platform’s whitelist. This identifies which file diverged and avoids treating a known variant as hostile.
  4. Send the result, build identifier and platform variant to the backend over an authenticated session.
  5. Combine the hash result with authenticity, account, session and gameplay signals before restricting an account.

Android App Bundles can split platform-specific files. ACTk documentation warns that this can make a summary hash differ across legitimate variants, so a single universal whitelist is unsafe. Register the exact files expected for each delivered split or use a manifest format that explicitly models the variant.

Hashing is not secret: an attacker can patch the verifier or replace the expected value in a modified client. Its value is in detecting accidental or unsophisticated modification, producing evidence for server-side policy and identifying unexpected files in builds that should be identical.

Use Steam DRM as a distribution layer, not a security boundary

When the game is distributed on Steam, Valve documents two wrapping paths: automated SteamPipe wrapping and manual wrapping through App Admin. Every build intended for publication must be wrapped. The wrapper verifies ownership, launches Steam before the game and mainly protects against extremely casual copying.

Valve explicitly states that “The Steam DRM wrapper by itself is not an anti-piracy solution.” A motivated attacker can remove it, so do not put purchase authority or competitive trust exclusively behind the wrapper. Keep your own server validation and integrity signals in place.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Sale
Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing
  • 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
  • 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
  • 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
  • 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
  • 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.

Make legitimate ownership valuable

Valve suggests Steamworks features such as online multiplayer, achievements, leaderboards and trading cards that do not function on non-legitimate copies. Design these as platform services with graceful failure: an outage or an unavailable service should not look identical to a tamper detection. Where your design permits, retain offline play and synchronize legitimate progress when the service returns.

Release and compatibility precautions

  • Test the final wrapped depot on a local content server before publishing.
  • Retain an unwrapped development build for debugging and crash reproduction.
  • Check for conflicts with other DRM tools; Valve warns that wrappers can conflict.
  • Run antivirus and endpoint-security checks on the wrapped binary. Valve notes that the injection involved in wrapping can trigger false positives.
  • Re-run your smoke tests after wrapping; a wrapper can change startup behavior even when game code is unchanged.

Compare the layers before choosing a protection budget

Layer Primary value What it cannot guarantee Operational cost and risk
IL2CPP Removes the easy managed-IL path and blocks managed assembly injection. Native binaries and metadata remain analyzable. More native build and debugging complexity; verify plugin and platform support.
Unity-aware obfuscation Renames or transforms managed symbols before metadata generation. Cannot keep client code secret or stop a determined patcher. Requires keep rules and regression testing for reflection, serialization and plugins.
Application.genuine Detects some post-build alterations where the platform supports the check. Can be patched or spoofed and may be unsupported on a platform. Resource-intensive; call at startup or checkpoints, not every frame.
Per-file and summary hashes Detects divergence from a trusted release and identifies changed files. Needs platform whitelists and can be bypassed in a modified client. CI manifest management; Android App Bundle variants require special handling.
Steam DRM wrapper Ownership check, Steam launch requirement and casual-copy deterrence. Is removable by a motivated attacker and is not a complete anti-piracy solution. Wrapping, depot testing, possible DRM conflicts and antivirus false positives.
Server validation Enforces entitlements, scores and economy decisions outside the client. Cannot protect purely offline rules or prevent all code inspection. Backend development, authentication, availability planning and support load.
Commercial or native protectors May add runtime checks or metadata encryption for stronger threat models. Compatibility, current pricing and independent benchmarks are not established by the cited guidance. Evaluate per Unity version, platform, crash behavior and update process.

Design responses that preserve player trust

A detector is evidence, not a verdict. False positives can come from a damaged installation, a platform-specific file split, an antivirus product, a failed service call or an unsupported integrity API.

Use graduated actions

  1. Log: retain the build, platform, manifest result, authenticity result and server response without exposing sensitive detector details to the player.
  2. Score: combine independent signals and require a pattern rather than one mismatch.
  3. Re-authenticate: ask the player to restart through the platform client, repair the installation or sign in again.
  4. Restrict high-value features: pause leaderboard, trading or competitive submissions while leaving local play and saves available when safe.
  5. Review: investigate repeated, corroborated signals before an account action.
  6. Ban only under a documented policy: ACTk guidance recommends combining detector output, code-hash results and backend heuristics to reduce false positives before bans.

Never delete a save as an integrity response. A tamper policy should be reversible where possible, explain what the player can do next and provide a support path for a legitimate installation that was misclassified.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Test the complete release, not just the editor build

Build and platform matrix

  • Test Mono development, IL2CPP release, every target architecture and each store-specific packaging variant.
  • Test clean installation, update over an older version, rollback prevention and repair after a damaged file.
  • Test offline startup, temporary service outage, clock changes and a delayed return to online play.
  • Test legitimate antivirus products and endpoint policies against the wrapped binary.
  • Test old saves, localized content, reflection paths, native plugins and network compatibility after obfuscation.

Controlled tamper cases

  • Change one managed or native file and confirm that the per-file diagnostic identifies it.
  • Change a file that legitimately differs between Android App Bundle splits and confirm that the correct whitelist accepts it.
  • Patch a client-side branch in a test environment and verify that the server still rejects an invalid entitlement or score.
  • Simulate an unsupported authenticity API and ensure the result is recorded as unavailable, not automatically hostile.
  • Remove or alter the Steam wrapper in a lab build and confirm that online ownership-dependent services fail safely rather than corrupting local progress.

A practical release checklist

  1. Document the threat model, trust boundary and offline policy.
  2. Move purchases, entitlements, competitive results, matchmaking authority and economy mutations to authenticated server flows.
  3. Confirm IL2CPP support and build the release configuration.
  4. Obfuscate managed code before IL2CPP; review and test keep rules.
  5. Generate per-file and summary hashes in CI, with manifests per platform and variant.
  6. Integrate authenticity checks at startup and sensitive checkpoints, respecting unsupported platforms and the resource cost of the check.
  7. Register expected hash results with the backend and combine signals before account action.
  8. Wrap Steam builds through the supported SteamPipe or App Admin process, then test the final depot.
  9. Run antivirus, crash, upgrade, offline and tamper tests on the exact artifacts you will publish.
  10. Ship a documented, graduated response that protects saves and gives legitimate players a recovery path.

Common failure modes and fixes

“IL2CPP made reverse engineering impossible.”

It did not. IL2CPP removes intermediate IL and managed injection, but native code and metadata remain available for analysis. Add obfuscation before conversion, move high-value authority to the server and treat client checks as detection signals.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

“The hash changed on Android even though nobody modified the game.”

Check whether the device received a different App Bundle split. Maintain per-platform and per-variant manifests instead of comparing every installation with one summary value.

Best Value
Sale
Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk
  • 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
  • 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
  • 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
  • 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
  • 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.

“A legitimate player was blocked after a single check.”

Review unsupported APIs, damaged files, antivirus interference and service failures. Replace single-signal punishment with logging, corroboration, re-authentication and temporary online-feature restrictions.

“Steam wrapping broke startup or triggered antivirus.”

Test the final wrapped depot, check for other DRM conflicts and retain an unwrapped build for diagnosis. Valve documents both compatibility conflicts and antivirus false positives caused by the wrapper’s binary modification.

“Obfuscation broke saves or networking.”

Add explicit keep rules for serialized fields, reflection names, save formats and network contracts, then test migration from an older save and communication between the protected client and server.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Frequently Asked Questions

Should an indie Unity game use Mono or IL2CPP for release?

Use IL2CPP when your target platforms, native plugins and debugging workflow support it. It removes the intermediate-IL path and managed assembly injection, but it does not hide native binaries or metadata.

Can code obfuscation protect an API key embedded in the game?

No. A key shipped to the client can be recovered or intercepted. Keep secrets and purchase authority on a server; use obfuscation only to raise the cost of understanding client code.

How often should Application.genuine be checked?

Unity describes the property as resource-intensive. Check at startup and before sensitive operations, with only a few additional controlled checkpoints rather than every frame.

Is Steam DRM enough to stop piracy?

No. Valve says the wrapper verifies ownership and deters extremely casual copying, but a motivated attacker can remove it. Pair it with server validation and integrity signals.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What should happen when a hash or authenticity check fails?

Record the signal, combine it with backend and gameplay evidence, and prefer repair, re-authentication or restricting high-value online features before any permanent account action. Never delete saves automatically.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.