In July 2023, I released a unique build extension tool on the Unity Asset Store (UAS). It was built to fully automate IL2CPP metadata encryption to prevent automated dumping. Encrypting metadata without breaking the engine's workflow, let alone automating the process, was unheard of at the time; it was usually achievable by large studios with access to Unity's source code. The Mfuscator asset allowed you to import the package, hit build, and have the protection applied automatically. It got more popular than I anticipated, and I saw adoption in massive titles, like VRChat, Realm of the Mad God, and others. Three years later, people are still buying and relying on it.
The Flaw in Public Distribution
The success of the Asset Store version proved one of my concerns in selling security tools publicly. Anyone with seventy euros can buy the asset. That includes the people trying to cheat in your games. They can download the package, study the code, and use what they learn to make manual dumping easier - or build automated dumpers outright. Selling a static product to defend against a dynamic threat does have limits.
Moving to the Cloud: Mfuscator SaaS
I built Mfuscator SaaS to solve this, along with the other structural limits of a storefront-distributed product - piracy risk, revenue share, and Unity Asset Store's guideline constraints among them. It's a separate, independent of the Asset Store, cloud-based platform. A cloud model fixes the accessibility problem: every new Organization is manually vetted before being granted access, the same way Unity reviews assets or Steam reviews games. Cheaters and reverse engineers who try to sign up get filtered out before they reach the platform. That keeps the tool out of the hands of the people trying to crack it and makes the product you're paying for more effective.
UAS vs. SaaS Comparison
The SaaS version is significantly more technically advanced. Here's how the two approaches compare:
| Feature | Unity Asset Store (UAS) | Mfuscator SaaS |
|---|---|---|
| Core Defense | Fights dumping through absolute randomization - every build generates unique layouts and initialization patterns. | Built on a custom x86 and ARM64 virtualizer that recompiles critical machine code into a dynamically generated, architecture-agnostic instruction set - the same class of protection used by tools like Themida or VMProtect. |
| Engine Impact | Encrypts IL2CPP metadata automatically at build time, without altering the engine's normal workflow or build architecture. | Mutates the engine itself - weaving call graphs, stripping vulnerable logic, breaking mod loaders, and blocking debuggers. |
| Infrastructure | Local Unity package; runs on the developer's machine. | Runs off-device, in a high-performance cloud cluster. |
| Effectiveness | Even with full understanding of the mechanism, building an automated dumper is time-consuming and low-reward. | Because the executed code is dynamically generated and never matches the original machine code twice, static analysis tools and debuggers have no stable target to work from. |
| Pricing & Access | Publicly accessible static product - anyone can buy it. | Pay only for successful builds - sometimes not even then. |
At the time, the Asset Store version isn't going away - it remains a local option for developers who need basic protection without relying on an external service. The SaaS platform is for any developers and teams that need enterprise-grade defense and are ready to move beyond what a local Unity package can offer.
If dumping, cheating, or IL2CPP reverse engineering is an potential/active problem for your studio, apply for access - new Organizations are reviewed and onboarded on a rolling basis.
Thank you for trusting Mfuscator to protect your hard work.
