Map Protection Details

EdgeOfChaos

E

EdgeOfChaos

On Map Protection
This tutorial will look at the pros and cons of map protection vs. open source, as well as what map protectors can do.

First, let’s look at what your typical map protector does and what each of these steps mean:

1) Deletes World Editor Only files
2) Obfuscates map script
3) Widgetize the objects (only some do this)
4) Corrupts the MPQ file (only some do this)

Deleting World Editor Only Files
When you create a map with the World Editor, there are two types of files: game files, and editor-only files. An example of a game file is war3map.j (scripts) or war3map.w3u (units). These files are required for the game to play. If they are not present, the game will not work. However there are also files created only for the World Editor to read, like war3map.wtg (GUI triggers). These files are totally optional to WC3, and can be safely deleted. This was the earliest level of protection discovered in WC3: if you delete all the WE only files, then the map will not open in World Editor unless they are regenerated.

The issue with this form of protection is that… well, the world editor only files are by definition not needed. Clearly WC3 doesn’t need them, and any experienced map editor doesn’t either. Keep in mind that the scripts, object, imports, etc. are ALL needed. Basically, deleting these files only restricts opening it in the World Editor and prevents GUI use.

That doesn’t matter since anyone experienced enough to edit someone else’s map will be able to write JASS. And there are tools that are even better than the world editor for writing JASS. Editing objects is also quite easy. This form of protection only stops the very noobiest of hackers, the type that will go in and change the author to their name or something like that.

It’s worth stopping these people, I suppose, but honestly any editing they do is going to be garbage and will never get played over the original anyways.

Obfuscating the Map Script
Now we're getting somewhere. Vexorian’s Optimizer obfuscates the map script, which means that it will mess up variable and function names to make them meaningless and remove code indentation. Take a VJASS snippet like this:

JASS:
private function onInit takes nothing returns nothing
  set deathTrigger = CreateTrigger()
  call TriggerRegisterAnyUnitEventBJ(deathTrigger, EVENT_PLAYER_UNIT_DEATH)
  call TriggerAddAction(deathTrigger, function dropItems)
  call TriggerAddCondition(deathTrigger, Condition(function isUnitEnemy))
endfunction

Hopefully it’s pretty clear what this trigger’s going to do. This is an item drop trigger that fires when an enemy dies. Now if we obfuscate it, it would look something like this:

JASS:
private function pqjf takes nothing returns nothing
set ghdn = CreateTrigger()
call TriggerRegisterAnyUnitEventBJ(ghdn, EVENT_PLAYER_UNIT_DEATH)
call TriggerAddAction(ghdn, function jkmv)
call TriggerAddCondition(ghdn, Condition(function Kdms))
endfunction

Now the meaning is entirely lost. Now this level of protection is actually meaningful. Code becomes far harder to read when it is obfuscated. But here’s the thing: an experienced map editor will still be able to understand it. The function calls above are enough to figure it out. All you have to do is search for those functions and write down your findings in a notepad, and you will be able to figure out what it’s doing.

This may double or triple the time needed to edit a map, but it will not stop anyone who wants to edit it.

Widgetizing the Objects
I only include this for completeness. Very few people do this. Basically it involves obscuring the objects by placing them in spreadsheets instead of the normal .w3u etc. files, which surprisingly, WC3 accepts. But people invented a dewidgetizer, so this doesn’t matter anymore.

Also it introduces glitches into your map which is the main reason this is rarely used nowdays.

Corrupting the MPQ
MPQ is the file format that .w3x and .w3m files are. Some very clever people found some specific hex addresses you can edit in a MPQ file to make the most common MPQ reading tools fail on it. This will indeed prevent those libraries from opening your map’s MPQ. But, WC3 needs to be able to read the map to play it. WC3 uses a library called storm which can open any valid MPQ file. And people have found out how to use this library in their tools. What this means is:

Any map that WC3 can open and play, anyone else can also open and read

People have spent years developing these MPQ corrupting tools, only to be foiled by storm, which already existed. Doing this method will only slow an editor down for about 10 minutes while they reconstruct the MPQ or repair it in a hex editor. This can result in a loss of imported files (see section: on MPQ format) but if someone is hacking your map, they don’t care about losing a couple imports.

So what can we do?
First let me ask this: why do you want to protect? Why does it matter if someone opens your map?

In an RPG this is somewhat understandable: it would make it easy to hack and generate your codes. Though you might argue that all this would do is ruin the hacker’s fun, and it’s not even much easier than hacking a protected map.

The other concern is that other people might edit your map and publish it as their own. First of all, I have never seen an instance of a map that is actively being made being stolen. Second: if you are an established mapmaker in any forum or discord, people will play your official version over any other. Third: any edit is likely to be crap. Editing someone else’s map is not easy and someone who’s good enough to do that probably won’t be stealing your work. They’ll be making their map. Or, perhaps, editing a map that’s been dead for years.

The only other reason I can think of is that you don’t want people to see your code. I can’t understand people who are secretive about their code. You’re not making any money off this, and showing others your code will only increase the quality of games over time as people learn from you and get better.

Open source?
My own personal compromise for maps that I make is this:
  • I run the Map Optimizer on the public release version. This is to get the performance benefit that the optimizer gives, as well as stopping the bad/lazy hackers.
  • I release the open source version after deleting the code system (if applicable) from the map, on the main thread and on my maps repository.
If anyone feels that can improve on my maps, they can do so and release them.

On the MPQ format
We all (hopefully) know what a .zip file is. Imagine that an MPQ file is a .zip file that we don’t know the contents of. We can see that there are files in it, but we can’t see what that file is. That is, unless we know the name of the file. Then we can import a listfile which is a list of hundreds of thousands (or millions) of common file names, which will discover most/all of the files in the map. After we know the name of a file in the MPQ, it can be extracted.

This is why reconstructing an MPQ can lead to a loss of imports. We might not know every import, so they can’t all be extracted, and when the MPQ is remade, it will be missing those. This is the only serious effect of corrupting an MPQ. Although, a corrupt MPQ can be repaired with a hex editor anyways.
 
Last edited by a moderator:

Dr Super Good

Spell Reviewer
Level 60
Joined
Jan 18, 2005
Messages
26,838
After we know the name of a file in the MPQ, it can be extracted.
Only if the file is encrypted in the MPQ. World Edit does not encrypt files. If the file is not encrypted you might not know its name but you can still extract it and read its contents. Even encrypted files of some content types can be decrypted and extracted without knowing the file name using a method similar to how the British decrypted Enigma transmissions during World War 2 due to the nature of some of the file formats.
This is why reconstructing an MPQ can lead to a loss of imports. We don’t know every import, so they can’t all be extracted, and when the MPQ is remade, it will be missing those.
Not if one does a programmatic analysis of the map content. If one parses all object data one can find many of the missing icon and model paths. If one parses the JASS script and looks for string constants one can find many of the missing special effect model paths. If one parses all identified imported models one can find many of the missing custom texture paths. Maybe a few will escape, especially ones that are never referenced, however enough should be found that for most maps one can considered no assets missing.
 
Last edited:
Finaly. I think such thread is useful.
  • Links to tools, including mpq editor would be useful.
  • Some more formatting would be good, too. It's okay, but a bit of bb code could make it nicer.
  • Widgetizer was made to decrease loading times, optimizer to reduze file size, but not to protect. Maybe it's worth to be known.
  • Some more info in "corrupting MPQ" would be cool. In addition you might also maybe link somewhere, where it's explained /shown (?)

  • Is it possible we give it a bit more structure? Like
    1. Intro
    2. Tequniques
    2. 1 Tequnique One
    2. 1.1 How to do it
    2. 1.2 How people work around / solve it
    2. 2 Tequnique Two
    ...
    3. Why to protect code
    3. 1 pros
    3. 2 cons
    4. (Personal) Conclusion
 
Level 23
Joined
Mar 15, 2012
Messages
2,690
I'd like to add that map corruption has really leaped ahead in terms of protecting the map like even making maps unable to be hosted by bots without a specific config file for it. Though as long someone keeps updating MPQ reading programs then there'll never be a level reached where it'll stop all reading without wrecking the map itself. The best protection relies on how well you can use JASS and secrets kept secret.

https://cdn.discordapp.com/attachments/369212022153543682/418133551591194626/unknown.png Shows that some other wc3 communities have found some interesting corruption methods even against stormlib.
 

Dr Super Good

Spell Reviewer
Level 60
Joined
Jan 18, 2005
Messages
26,838
Worth noting that the more one corrupts a map archive the higher the chances of it breaking in a future update of WC3 are. Many of the "corruption" methods used rely on poorly defined and specific behaviour of WC3's MPQ archive library. For security or maintenance reasons it is possible that much of such behaviour is fixed in the future resulting in those archives becoming unreadable.

For example they might explicitly add a test to make sure the MPQ archive version is 0 which would break all maps that had that field corrupted. This might happen if they decide to incorporate StarCraft II's more advanced MPQ format which allows bigger archives and better compression algorithms. For this reason I strongly recommend not corrupting a map's MPQ archive. Rather obfuscate and add hidden tripwires to triggers, making unauthorized editing of the map seem easy but it is not.
 
  • Like
Reactions: pyf

pyf

pyf

Level 31
Joined
Mar 21, 2016
Messages
2,986
Worth noting that the more one corrupts a map archive the higher the chances of it breaking in a future update of WC3 are. Many of the "corruption" methods used rely on poorly defined and specific behaviour of WC3's MPQ archive library. For security or maintenance reasons it is possible that much of such behaviour is fixed in the future resulting in those archives becoming unreadable. [...]

[Someone]'s MPQ Editor v3.5.1.794 (Unicode build; uses StormLib v9.11; August 2015)
:piru:
:hohum:
 

EdgeOfChaos

E

EdgeOfChaos

Even rather than obfuscating, I would just have a strong community around the map and a central source to get downloads. Korean RPGs have this down well. People don't play with cheaters, and everyone gets the map from either cafe or some English-run forum. This makes it hard to create your own versions of the map, even for people with editing knowledge. Same with DotA: no one plays cheated versions of it. Autohost bots by the maker are another way of doing this. When I was still developing my map a lot, I had a discord for it where people got downloads. Of course, this is much more difficult to set up than press button -> obfuscate map. If you aren't OK with your secret coding methods being revealed, then just don't release the map.

Terrain can't really be protected at all.
There is a file in the MPQ that holds terrain data and it should never be corrupt.
Terrain data can easily be extracted and viewed as-is, I think there are even tools to do it. Preplaced units/doodads will be much more difficult.

Did not know that about stormlib, thanks!
 
Last edited by a moderator:
Even rather than obfuscating, I would just have a strong community around the map and a central source to get downloads. Korean RPGs have this down well. People don't play with cheaters, and everyone gets the map from either cafe or some English-run forum. This makes it hard to create your own versions of the map, even for people with editing knowledge. Same with DotA: no one plays cheated versions of it. Autohost bots by the maker are another way of doing this. When I was still developing my map a lot, I had a discord for it where people got downloads. Of course, this is much more difficult to set up than press button -> obfuscate map. If you aren't OK with your secret coding methods being revealed, then just don't release the map.

Cool idea. I could definitely see that working with wc3. The players are all a pretty close-knit community, and most people tend to be loyal to the original author unless they've been inactive.

P.S. I really like your mentality towards protection. While I respect that some people want to keep their stuff closed source, people like you really help the community grow. :)
 

Chaosy

Tutorial Reviewer
Level 40
Joined
Jun 9, 2011
Messages
13,167
A easy way to prevent your map from being edited:

Write map in wurst, code is injected into the map after being compiled.
Meaning that when you save the map in the WE your code gets deleted.

Without the source files your code cannot be modified. Just keep those close.

I guess you could open the map in mpq editor and directly modify the script file, but that has not worked when I tried it years back. Maybe I did something wrong.
 
Level 39
Joined
Jun 23, 2007
Messages
4,058
A easy way to prevent your map from being edited:

Write map in wurst, code is injected into the map after being compiled.
Meaning that when you save the map in the WE your code gets deleted.

Without the source files your code cannot be modified. Just keep those close.

I guess you could open the map in mpq editor and directly modify the script file, but that has not worked when I tried it years back. Maybe I did something wrong.

Yeah using wurst won't help you in regards to map protection. Like you said you can just open the MPQ and edit the script directly.

@EdgeOfChaos is completely right. A community with official download sources and hostbots is the best way. There are various methods of MPQ protection that can stop some people, but for anyone who knows what they are doing it's trivial. A more effective type of protection uses many checksums in the map script to make sure gameplay is valid. You can also run some of these checks in hidden code (.ai files or .j files disguised as .mdx or something).

Also, I am working on modifying ghost++ (hostbot) to stream data into running maps. This will allow map makers to store their players data on a server and load it in-game without players having to type anything. This means players can't easily cheat their characters when they play on your hostbot. If they want to play an unoffical version of the map, or host it themselves, then the map can default to standard disk save/load.
 
Last edited:
Level 23
Joined
Mar 15, 2012
Messages
2,690
At least it makes it slightly more difficult without preventing the map to be opened ^^
It won't be any different from being just a step below vex's optimizer or around it, wurst is just a syntax and must convert to JASS which is held in the .j script in every single map. Sadly that won't change a thing since the world editor isn't used anyways.
 

EdgeOfChaos

E

EdgeOfChaos

Yeah Dat-C3 is right. In the map archive, you can think of the war3map.wtg as being the human readable code. This file can be deleted by Vex's or any other protection method. It sounds like Wurst just never generates you a .wtg in the first place, which has the same effect as deleting it. If a map should be playable on wc3, then the real map script is located in one of two places, and called war3map.j. This is unavoidable. Unfortunately anything we do in Wurst/VJass/whatever, it is all limited by JASS anyways. You can make the syntax nicer, but you can't make it do anything new.

This is another reason why some of the "language wars" here are silly, there aren't any functional differences between any of them (besides GUI, but even there you can put in custom script). Don't get me wrong, I love my vjass because it saves me time using parallel arrays when I can use structs instead, but that's all it is.. I mean I suppose eventually everything becomes machine code instructions anyways, but we're talking high level -> high level language here, not to a lower one.

When blizzard adds new natives to WE, then we will be able to do new stuff :D

Storing saves on a server would be huge. This would also mean doing away with save codes altogether (that is, not shown to the user but used internally)
 
Last edited by a moderator:
Level 39
Joined
Jun 23, 2007
Messages
4,058
Storing saves on a server would be huge. This would also mean doing away with save codes altogether (that is, not shown to the user but used internally)

I already have it working and I hope to get a PoC out very soon. Storing the save codes wasn't the problem (w3mmd could do that). The part I figured out is how to load codes into a running map.
 

Chaosy

Tutorial Reviewer
Level 40
Joined
Jun 9, 2011
Messages
13,167
Sadly that won't change a thing since the world editor isn't used anyways
I do not claim to be a map modifier so I do not know what most people do.

It sounds like Wurst just never generates you a .wtg in the first place, which has the same effect as deleting it.
No, wurst does not remove existing code. It simply adds existing code on top of it.
When I think about that.. maybe wurst is a really easy way to inject code into a protected map.
I do not know if it is possible, but theoretically it should.
I should diffidently try that sometime.

This is another reason why some of the "language wars" here are silly
I mean.. it is like comparing programming in binary code and.. well.. most languages.
both vjass and jass has a lot of useless crap keywords which really slows me down. However, decent for learning purposes.
It really is about saving time and preference, nothing else since speed is marginal at best.
 

EdgeOfChaos

E

EdgeOfChaos

All I'm saying is that it sounds like Wurst compiler never generates such world-editor-only data (since it is not modified in WE) which has a similar effect of optimizing it.
 

Dr Super Good

Spell Reviewer
Level 60
Joined
Jan 18, 2005
Messages
26,838
both vjass and jass has a lot of useless crap keywords which really slows me down
Welcome to structured basic.
Code:
DECLARE SUB PrintSomeStars (StarCount!)
REM QuickBASIC example
INPUT "What is your name: ", UserName$
PRINT "Hello "; UserName$
DO
   INPUT "How many stars do you want: ", NumStars
   CALL PrintSomeStars(NumStars)
   DO
      INPUT "Do you want more stars? ", Answer$
   LOOP UNTIL Answer$ <> ""
   Answer$ = LEFT$(Answer$, 1)
LOOP WHILE UCASE$(Answer$) = "Y"
PRINT "Goodbye "; UserName$
END

SUB PrintSomeStars (StarCount)
   REM This procedure uses a local variable called Stars$
   Stars$ = STRING$(StarCount, "*")
   PRINT Stars$
END SUB
This is why SC2 Galaxy focused on C since it avoided this nonsense such as call and end block.
 
Top