Protect Godot games from asset extraction.
Automated tools target common key patterns and PCK structures in exported games. ChaosProtector adds a post-build protection layer for Windows Godot exports.
Results depend on the Godot build and attacker tooling, so validate the protected output as part of release QA.
Client-side game assets need layered protection
PCK encryption is useful, but a shipped game must still be able to decrypt its assets. Public tooling can automate common extraction paths, so protect the executable and package together and test the result against the tools relevant to your release.
Automated extraction exists
Public tools can inspect Godot packages and recover compatible project data with little manual work. A layered post-build step raises the cost beyond the default export.
Free attack toolkit
KeyDot, gdke, GDRE Tools, and Godot-AES-key-extractor make common inspection and recovery techniques accessible. Treat them as part of a repeatable release regression suite rather than assuming the default export will resist them.
Project data is valuable
Scripts, scenes, shaders, models, and audio may all contain work you do not want redistributed. Protection cannot guarantee secrecy, but it can remove easy paths.
Recovery can be automated
Supported exports can be passed to recovery tools through a simple workflow. Scripts, scenes, shaders, models, and audio may then be available for inspection without rebuilding the package format manually.
The client must read its assets
Any client-side protection eventually processes keys and assets at runtime. The practical goal is to reduce recognizable patterns and add checks that make automated recovery less reliable, not to promise an unextractable client.
Choose the layers you need
Plain --godot hardens the EXE while leaving its PCK unchanged. Add --godot-pck-encrypt explicitly for Godot 4.2+ Windows x86-64 exports with an embedded, unencrypted PCK. No engine source changes are required, but the generated output still needs full release QA.
Why PCK encryption alone may not be enough
Key Extraction
KeyDot and gdke search exported binaries for recognizable key-related patterns. Add a second layer and verify whether those patterns remain usable in your build.
Full Project Recovery
GDRE Tools can recover compatible scripts, scenes, and assets from supported packages. Its result depends on the Godot version and package layout.
Choose and test an approach
Built-in encryption, source transformations, custom engine builds, and post-build protection have different trade-offs. Compare them on your actual export.
Explicit EXE and PCK protection modes.
# Harden the EXE and preserve the PCK
ChaosProtectorGui.exe --console -f mygame.exe --godot
# Godot 4.2+ Windows x86-64: encrypt an embedded, unencrypted PCK
ChaosProtectorGui.exe --console -f mygame.exe --godot --godot-pck-encrypt
String Encryption
Encrypts anchor strings used by common key-pattern scanners. The regression fixture exercised more than 109,000 strings with the configured keystream.
Anti-Debug
Adds the base debugger-state checks; Pro enables the advanced hook, anti-dump and instrumentation checks. Individual checks can still be bypassed.
Import Protection
Resolves protected imports through a PEB walk and encrypted data table, reducing the useful API names and cross-references exposed during static inspection.
PCK Asset Encryption
The opt-in --godot-pck-encrypt mode encrypts an embedded pack and its directory for Godot 4.2+ Windows x86-64 exports. At launch, the loader materializes a decrypted temporary PCK on disk and removes it best-effort; this is not an in-memory VFS. In the documented regression test, the tested GDRE Tools version could not parse the shipped protected PCK.
Anti-Disassembly
Adds anti-disassembly sequences intended to make supported static-analysis workflows less reliable. Validate the effect against your own tool versions.
Integrity Check
CRC32 verification of covered code sections plus a SizeOfImage check is intended to detect changes within the regions and metadata included by those checks.
Results against specific tool versions
The table records tests against a ChaosProtector-protected Godot 4.6.1 fixture. It does not guarantee the same result against future releases, custom tooling, or a determined manual analyst. Repeat the tests on your production build.
| Attack Tool | Technique | Without Protection | With ChaosProtector |
|---|---|---|---|
| KeyDot v1.0.3 | String anchor + LEA pattern | Key extracted in 50ms | FAILED - "Cannot locate key blob" |
| gdke v0.2.3 | GUI key extractor | Key displayed in GUI | FAILED - Anchor strings hidden |
| GDRE Tools v2.4.0 | Full project recovery | Complete project recovered | FAILED - "Cannot open file" |
| Custom XOR Brute-force | 256-key XOR scan on .rdata | Strings decrypted | FAILED - Non-linear PRNG |
| Brute-force LEA Scanner | All registers, all sections | 28K candidates | 113K candidates (noise) |
ChaosProtector vs existing solutions
| Feature | Built-in Encryption | GDMaim | Godot-Secure | ChaosProtector |
|---|---|---|---|---|
| Key extraction result (listed tool versions) | ✗ | ✗ | ✗ | No key found in documented tests |
| String encryption | ✗ | Partial | ✗ | Tested on a 109K-string fixture |
| Anti-debug | ✗ | ✗ | ✗ | Base checks; advanced Pro checks |
| PCK asset encryption | Built-in, client-held key | ✗ | Custom engine | Opt-in: Godot 4.2+ Windows x86-64 |
| Anti-disassembly | ✗ | ✗ | ✗ | Jump-chain analysis stress pattern |
| Integrity check | ✗ | ✗ | ✗ | CRC32 + SizeOfImage |
| Import protection | ✗ | ✗ | ✗ | PEB walk |
| No engine recompilation | ✗ Required | ✓ | ✗ Required | ✓ Post-build |
| Price | Free | Free | Free | $99 one-time |
Everything you need to know
Does Godot already have encryption? Why do I need ChaosProtector?
Godot's built-in PCK encryption still requires the decryption key to be available to the exported game at runtime. Tools such as KeyDot and gdke are designed to locate common key patterns in the binary. ChaosProtector adds post-build string and import protections to the EXE, with separate opt-in PCK protection intended to make automated extraction paths harder. Test the protected export against the exact Godot and tool versions relevant to your release.
Which attack tools are included in the regression tests?
The regression set currently covers KeyDot, gdke, GDRE Tools, Godot-AES-key-extractor patterns, custom scanners, and static-analysis workflows against defined test binaries. The versions shown on this page failed in those tests; that is not a guarantee against every future release or a custom manual attack. Re-run the checks on your own signed build before shipping.
Do I need to recompile the Godot engine?
No. ChaosProtector is a post-build tool. Export the game normally, then run the Godot protection command on the resulting Windows executable. No engine source changes or custom engine build are required. Ship the complete generated output, including the companion loader in the bin directory when present.
Does it work with Godot 3 and Godot 4?
Plain --godot EXE hardening currently detects Windows exports from Godot 3.5, 3.6, and 4.0 through 4.6, and preserves their PCK unchanged. The separate --godot-pck-encrypt mode has narrower requirements: Godot 4.2 or newer, Windows x86-64, and an embedded PCK with Godot built-in encryption disabled. Because export templates and extraction tools change, test the exact engine patch version and export preset used by your game.
How do I use it?
Use ChaosProtectorGodot.exe from the Godot package for the GUI. For automation, use ChaosProtectorGui.exe --console -f mygame.exe --godot from the standard Windows package. That command hardens the EXE and preserves the PCK. For a Godot 4.2+ Windows x86-64 export, you can encrypt an embedded, unencrypted PCK by adding --godot-pck-encrypt; this emits a companion loader that temporarily materializes a decrypted .pck on disk at launch. It is not an in-memory loader or VFS. Preserve the complete generated layout when uploading to Steam, itch.io, or your CDN.
Does ChaosProtector slow down my game?
The Godot preset does not virtualize the main engine loop, so its most visible overhead is normally during startup and asset loading rather than every frame. The exact cost depends on the executable, PCK size, storage, and customer hardware. Benchmark startup, loading, and frame times on representative machines before release.
Will my game still run on customer machines?
Protection changes the executable and asset-loading path, so compatibility must be part of release QA. Test the complete generated output on every supported Windows version, storefront, code-signing flow, and antivirus environment used by your audience. Keep the unprotected release and symbols available for diagnosis.
How much does it cost?
ChaosProtector has a Free plan, Basic at $99 one-time, and Pro at $199 one-time. Paid plans include one year of updates and support, and the purchased version remains usable afterward. Godot and advanced protection features vary by plan, so check the pricing page for the current matrix.
What about macOS and Linux builds?
The Godot PCK workflow described on this page targets Windows exports. ChaosProtector also has a separate native Linux ELF64 protection workflow, but that does not imply identical Godot PCK packaging on Linux. macOS Mach-O protection is not currently listed as supported.
From Godot export to protected .exe in 4 steps
No engine source changes or custom engine build are required. ChaosProtector is a post-build step: export normally, protect the resulting binary, and preserve every generated PCK or companion-loader file required by the mode you select. Read the step-by-step Godot protection guide for additional packaging and testing context.
Export from Godot
Open your project in the Godot editor. Go to Project → Export, select the Windows Desktop preset, and export your game. To use --godot-pck-encrypt, enable Embed PCK and leave Godot's built-in PCK encryption disabled: the opt-in mode requires an embedded, unencrypted pack from Godot 4.2+ for Windows x86-64. Plain --godotsupports the broader compatibility list, also accepts a separate PCK, and leaves it unchanged.
Project → Export → Windows Desktop → Export Project
Download ChaosProtector
Sign in to your Dashboard and grab the ChaosProtector for Godot bundle. It contains the dedicated GUI (ChaosProtectorGodot.exe). For command-line or CI/CD use, also download the standard Windows bundle, which contains the combined GUI and CLI (ChaosProtectorGui.exe). No installer is required.
unzip ChaosProtector-Godot.zip -d chaos/
Protect via GUI or CLI
GUI: launch ChaosProtectorGodot.exe, click Open File, select your exported mygame.exe. The GUI auto-detects Godot and enables EXE hardening. PCK encryption is a separate opt-in; enable it only for a Godot 4.2+ Windows x86-64 export with an embedded, unencrypted pack. Click Protect.
CLI (for CI/CD pipelines; remove --godot-pck-encrypt for EXE-only protection):
ChaosProtectorGui.exe --console -f mygame.exe --godot --godot-pck-encrypt -o mygame.protected.exe
Ship the protected binary
Upload the complete protected output before publishing to Steam, itch.io, GOG, or your own CDN. For compatible Godot 4.2+ Windows x86-64 exports, the opt-in PCK mode requires the generated bin/chaos_loader.windows.x86_64.dll. At launch it materializes a decrypted temporary PCK on disk and removes it best-effort on clean exit; it is not an in-memory loader or VFS. Keep the generated .pdb privately and run a clean-machine launch test against the exact folder you plan to distribute.
steamcmd +login anonymous +app_build build.vdf +quit
Test protection on your own Godot export
Start with the Free plan, validate the generated build, then compare paid features if you need more layers.
© 2026 ChaosProtector. All rights reserved.