Tomcat Thank you for your reply.
I have previously tried both encryption and obfuscation. However, since Godot itself is open source, AI models can often understand how the engine works and figure out where to look for the key. Even though my encryption was strong enough to make tools like GDRE Tools fail, an AI model could still spend some time analyzing the project and eventually recover the key container that I intentionally placed in my test project.
As you mentioned, it is impossible to completely prevent AI-assisted reverse engineering. I fully understand that. However, my goal is to at least prevent a situation where someone can simply take our game package, upload it to an AI tool, give it a single prompt, and receive the complete source code.
At the moment, I am modifying the encryption pipeline in the Godot 4.7.1 engine source code. For example, I replaced the default AES-CFB + MD5 approach with HKDF key derivation + AES-256-CTR encryption + HMAC-SHA256 authentication.
Of course, modifying the engine means the project becomes tied to this custom engine version, but I believe this trade-off is more acceptable than having the entire result of our work easily stolen.
I have already exported a test project using my modified engine, and so far it runs correctly on Android devices. However, the actual security level still needs further testing.
Thank you again for sharing your experience and advice.
