Your Godot game is naked.
KeyDot extracts your AES encryption key in 50 milliseconds. GDRE Tools recovers your entire project with drag-and-drop.
ChaosProtector is the first and only commercial protection tool for Godot Engine games.
Indie devs are the easiest targets on Steam
Godot ships with "encryption" that stores the key inside the binary. Any reverse engineer with 5 minutes of experience can extract it. Meanwhile, commercial piracy tools are evolving faster than engine defenses.
Cracked on launch
Scene groups automate Godot game cracking. Your title lands on torrent sites within hours of Steam release because GDRE Tools runs in one click. Every copy sold loses you 3–5 pirated downloads.
Free attack toolkit
KeyDot, gdke, GDRE Tools, Godot-AES-key-extractor, all free, all open source, all on GitHub with thousands of stars. The attack side is well-funded and battle-tested. You get nothing unless you bring your own protection.
Source code theft
It's not just asset piracy. Extracted scripts get re-skinned and reshipped as "new" games on itch.io and asset flip stores within weeks. Your months of work become someone else's Black Friday sale.
That's the attack window
Download your game, drag the .exe onto GDRE Tools, click "Recover". Thirty seconds later they have your entire project, scripts, scenes, shaders, 3D models, audio, everything. No skill required.
Because Godot is open source
The engine source tells attackers exactly where the encryption key is stored, what format the PCK uses, and how to patch the loader. Unity and Unreal hide behind proprietary code. Godot hides nothing.
Close the gap in one command
ChaosProtector wraps a commercial-grade PE protector around your Godot binary. AES keys hidden, strings encrypted, PCK mutated, imports destroyed, debuggers blocked. No engine recompilation. Ship protected today.
Godot games are the easiest to reverse engineer
Key Extraction
KeyDot and gdke extract your PCK encryption key from the binary in under a second. Your "encrypted" assets are wide open.
Full Project Recovery
GDRE Tools (3,300+ GitHub stars) recovers your complete Godot project — scripts, scenes, assets — with a single drag and drop.
Existing Solutions
There are zero commercial protection tools for Godot. GDMaim only renames variables. Godot-Secure requires recompiling the engine from source.
One command. Total protection.
# Protect your Godot game
ChaosProtector.exe mygame.exe --godot
String Encryption
Hides the anchor strings that KeyDot uses to find your AES key. 109,000+ strings encrypted with non-linear PRNG keystream.
Anti-Debug
15 PEB-based checks prevent runtime debugging and key interception. VirtualProtect hook blocks Cheat Engine memory patches.
Import Protection
PEB walk + encrypted data table destroys the Import Address Table. Hides all API calls from static analysis tools.
PCK Asset Encryption
Mutates the GDPC magic header and encrypts all file contents and directory. No existing extraction tool can parse the protected PCK.
Anti-Disassembly
CVE-2024-44083 exploit chain crashes IDA Pro during static analysis. 250KB of jump chains in a dedicated section.
Integrity Check
CRC32 verification of code sections + SizeOfImage check. Detects any binary patching attempt at runtime.
We attacked our own protection
We downloaded every public Godot reverse engineering tool and tested them against a ChaosProtector-protected Godot 4.6.1 game.
| Attack Tool | Technique | Without Protection | With ChaosProtector |
|---|---|---|---|
| KeyDot v1.0.3 | String anchor + LEA pattern | Key extracted in 50ms | FAILED - "Cannot locate key blob" |
| gdke v0.2.3 | GUI key extractor | Key displayed in GUI | FAILED - Anchor strings hidden |
| GDRE Tools v2.4.0 | Full project recovery | Complete project recovered | FAILED - "Cannot open file" |
| Custom XOR Brute-force | 256-key XOR scan on .rdata | Strings decrypted | BLOCKED - Non-linear PRNG |
| Brute-force LEA Scanner | All registers, all sections | 28K candidates | 113K candidates (noise) |
ChaosProtector vs existing solutions
| Feature | Built-in Encryption | GDMaim | Godot-Secure | ChaosProtector |
|---|---|---|---|---|
| Key hidden from extractors | ✗ | ✗ | ✗ | ✓ |
| String encryption | ✗ | Partial | ✗ | 109K strings |
| Anti-debug | ✗ | ✗ | ✗ | 15 checks |
| PCK asset encryption | Weak (key in binary) | ✗ | Custom engine | Per-file encryption |
| Anti-disassembly | ✗ | ✗ | ✗ | CVE-2024-44083 |
| Integrity check | ✗ | ✗ | ✗ | CRC32 + SizeOfImage |
| Import protection | ✗ | ✗ | ✗ | PEB walk |
| No engine recompilation | ✗ Required | ✓ | ✗ Required | ✓ Post-build |
| Price | Free | Free | Free | $99 one-time |
Everything you need to know
Does Godot already have encryption? Why do I need ChaosProtector?
Godot's built-in PCK encryption stores the AES key inside the compiled binary. Any reverse engineer can extract it in under a second using free tools like KeyDot or gdke. ChaosProtector hides the key by encrypting the anchor strings, scrambling instruction patterns, and destroying the import table, so the extraction tools can no longer find it.
Which attack tools does ChaosProtector block?
ChaosProtector blocks all publicly available Godot reverse engineering tools: KeyDot (AES key extraction), gdke (GUI key extractor), GDRE Tools (full project recovery, 3,300+ GitHub stars), Godot-AES-key-extractor (brute-force LEA scanner), custom XOR brute-force scanners, and generic IDA Pro / Ghidra static analysis. It was tested against Godot 4.6.1 with every public extraction tool and all of them failed on the protected binary.
Do I need to recompile the Godot engine?
No. ChaosProtector is a post-build tool. You export your game normally from the Godot editor, then run a single command on the resulting .exe. No engine source changes, no custom builds, no GDExtension required. Unlike Godot-Secure which needs a full engine recompilation, ChaosProtector is a drop-in protection step at the end of your build pipeline.
Does it work with Godot 3 and Godot 4?
Yes. ChaosProtector auto-detects the Godot engine version by scanning the binary for version signatures. It supports Godot 3.5, 3.6, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, and 4.6. PCK encryption works on all versions. The AES key hiding logic targets the specific code patterns the extraction tools look for, which are stable across Godot versions.
How do I use it?
One command: ChaosProtector.exe mygame.exe --godot. This auto-detects the Godot engine, applies the full Godot preset (string encryption, anti-debug, import protection, PCK mutation, integrity check), and produces mygame.protected.exe. That is your distributable binary. Replace the original .exe with the protected one before uploading to Steam, itch.io, or your CDN.
Does ChaosProtector slow down my game?
The runtime overhead is negligible for Godot games because the engine loop itself is not virtualized, only the protection hooks run at startup. The startup decryptor takes about 200ms on average for a 100MB binary. Frame rate and gameplay performance are unaffected.
Will my game still run on customer machines?
Yes. ChaosProtector uses standard Windows APIs and PEB walks that work on Windows 7 and newer. It does not install drivers, does not require admin privileges, and does not trigger antivirus false positives in our testing with Windows Defender, Bitdefender, and Kaspersky. If your customers can run a regular Windows game, they can run your protected game.
How much does it cost?
ChaosProtector has three tiers: Trial (free, limited), Basic ($99/yr), and Pro ($199/yr). The Godot protection preset is available on Basic and Pro. See the pricing page for the full comparison.
What about macOS and Linux builds?
ChaosProtector supports Windows PE binaries (32-bit and 64-bit) and Linux ELF64 binaries natively, sharing the same ChaosVM virtualization engine. macOS (Mach-O) is still on the roadmap. If you ship on Windows and Linux, the same toolchain protects both.
From Godot export to protected .exe in 4 steps
No engine recompilation, no GDExtension, no SDK integration. ChaosProtector is a post-build step: export your game normally, then protect the resulting binary.
Export from Godot
Open your project in the Godot editor. Go to Project → Export, select the Windows Desktop preset, and export your game as usual. Godot's built-in PCK encryption is optional — ChaosProtector adds its own layer on top.
Project → Export → Windows Desktop → Export Project
Download ChaosProtector
Sign in to your Dashboard and grab the ChaosProtector for Godot bundle. It contains the GUI (ChaosProtectorGui.exe) and the CLI, ready to use out of the box. No installer, just unzip and run.
unzip ChaosProtector-Godot.zip -d chaos/
Protect via GUI or CLI
GUI: launch ChaosProtectorGui.exe, click Open File, select your exported mygame.exe. The GUI auto-detects Godot and enables the Godot preset (string encryption, anti-debug, import protection, PCK mutation, integrity check, anti-disassembly). Click Protect.
CLI (for CI/CD pipelines):
ChaosProtector.exe mygame.exe --godot --output mygame.protected.exe
Ship the protected binary
Replace your original .exe with mygame.protected.exebefore uploading to Steam, itch.io, GOG, or your own CDN. Keep the generated.pdb file privately for crash-dump debugging. Your players get the same game; attackers get 113K fake AES candidates instead of one real key.
steamcmd +login anonymous +app_build build.vdf +quit
Stop giving your game away for free
Protect your Godot game in one command. No engine recompilation needed.
Get ChaosProtector
© 2026 ChaosProtector. Alle Rechte vorbehalten.