Protect Godot games from asset extraction.
Automated tools target common key patterns and PCK structures in exported games. ChaosProtector adds a post-build protection layer for Windows Godot exports.
Results depend on the Godot build and attacker tooling, so validate the protected output as part of release QA.
Client-side game assets need layered protection
PCK encryption is useful, but a shipped game must still be able to decrypt its assets. Public tooling can automate common extraction paths, so protect the executable and package together and test the result against the tools relevant to your release.
Automated extraction exists
Public tools can inspect Godot packages and recover compatible project data with little manual work. A layered post-build step raises the cost beyond the default export.
Free attack toolkit
KeyDot, gdke, GDRE Tools, and Godot-AES-key-extractor make common inspection and recovery techniques accessible. Treat them as part of a repeatable release regression suite rather than assuming the default export will resist them.
Project data is valuable
Scripts, scenes, shaders, models, and audio may all contain work you do not want redistributed. Protection cannot guarantee secrecy, but it can remove easy paths.
Recovery can be automated
Supported exports can be passed to recovery tools through a simple workflow. Scripts, scenes, shaders, models, and audio may then be available for inspection without rebuilding the package format manually.
The client must read its assets
Any client-side protection eventually processes keys and assets at runtime. The practical goal is to reduce recognizable patterns and add checks that make automated recovery less reliable, not to promise an unextractable client.
Close the gap in one command
ChaosProtector applies string, PCK, import, anti-debug, and integrity layers after export. No engine source changes are required, but the generated output still needs full release QA before distribution.
Why PCK encryption alone may not be enough
Key Extraction
KeyDot and gdke search exported binaries for recognizable key-related patterns. Add a second layer and verify whether those patterns remain usable in your build.
Full Project Recovery
GDRE Tools can recover compatible scripts, scenes, and assets from supported packages. Its result depends on the Godot version and package layout.
Choose and test an approach
Built-in encryption, source transformations, custom engine builds, and post-build protection have different trade-offs. Compare them on your actual export.
One command. Layered post-build protection.
# Protect your Godot game
ChaosProtector.exe mygame.exe --godot
String Encryption
Encrypts anchor strings used by common key-pattern scanners. The regression fixture exercised more than 109,000 strings with the configured keystream.
Anti-Debug
Layers 15 PEB-based checks with runtime protections intended to detect common debugging and memory-patching workflows. Individual checks can be bypassed.
Import Protection
Resolves protected imports through a PEB walk and encrypted data table, reducing the useful API names and cross-references exposed during static inspection.
PCK Asset Encryption
Mutates the GDPC magic header and encrypts all file contents and directory. In the documented regression test, the tested GDRE Tools version could not parse the protected PCK.
Anti-Disassembly
Adds anti-disassembly sequences intended to make supported static-analysis workflows less reliable. Validate the effect against your own tool versions.
Integrity Check
CRC32 verification of covered code sections plus a SizeOfImage check is intended to detect changes within the regions and metadata included by those checks.
Results against specific tool versions
The table records tests against a ChaosProtector-protected Godot 4.6.1 fixture. It does not guarantee the same result against future releases, custom tooling, or a determined manual analyst. Repeat the tests on your production build.
| Attack Tool | Technique | Without Protection | With ChaosProtector |
|---|---|---|---|
| KeyDot v1.0.3 | String anchor + LEA pattern | Key extracted in 50ms | FAILED - "Cannot locate key blob" |
| gdke v0.2.3 | GUI key extractor | Key displayed in GUI | FAILED - Anchor strings hidden |
| GDRE Tools v2.4.0 | Full project recovery | Complete project recovered | FAILED - "Cannot open file" |
| Custom XOR Brute-force | 256-key XOR scan on .rdata | Strings decrypted | FAILED - Non-linear PRNG |
| Brute-force LEA Scanner | All registers, all sections | 28K candidates | 113K candidates (noise) |
ChaosProtector vs existing solutions
| Feature | Built-in Encryption | GDMaim | Godot-Secure | ChaosProtector |
|---|---|---|---|---|
| Key hidden from extractors | ✗ | ✗ | ✗ | ✓ |
| String encryption | ✗ | Partial | ✗ | Tested on a 109K-string fixture |
| Anti-debug | ✗ | ✗ | ✗ | 15 checks |
| PCK asset encryption | Built-in, client-held key | ✗ | Custom engine | Per-file encryption |
| Anti-disassembly | ✗ | ✗ | ✗ | CVE-2024-44083 |
| Integrity check | ✗ | ✗ | ✗ | CRC32 + SizeOfImage |
| Import protection | ✗ | ✗ | ✗ | PEB walk |
| No engine recompilation | ✗ Required | ✓ | ✗ Required | ✓ Post-build |
| Price | Free | Free | Free | $99 one-time |
Everything you need to know
Does Godot already have encryption? Why do I need ChaosProtector?
Godot's built-in PCK encryption still requires the decryption key to be available to the exported game at runtime. Tools such as KeyDot and gdke are designed to locate common key patterns in the binary. ChaosProtector adds post-build string, import, and PCK protections intended to make those automated extraction paths harder. Test the protected export against the exact Godot and tool versions relevant to your release.
Which attack tools are included in the regression tests?
The regression set currently covers KeyDot, gdke, GDRE Tools, Godot-AES-key-extractor patterns, custom scanners, and static-analysis workflows against defined test binaries. The versions shown on this page failed in those tests; that is not a guarantee against every future release or a custom manual attack. Re-run the checks on your own signed build before shipping.
Do I need to recompile the Godot engine?
No. ChaosProtector is a post-build tool. Export the game normally, then run the Godot protection command on the resulting Windows executable. No engine source changes or custom engine build are required. Ship the complete generated output, including the companion loader in the bin directory when present.
Does it work with Godot 3 and Godot 4?
ChaosProtector detects supported Godot builds from version signatures. The current compatibility list covers Godot 3.5, 3.6, and 4.0 through 4.6. Because export templates and extraction tools change, test the exact engine patch version and export preset used by your game.
How do I use it?
Run ChaosProtector.exe mygame.exe --godot after exporting the Windows game. The command detects the Godot build, applies the Godot preset, protects the PCK, and creates the protected executable plus any required companion loader files. Preserve the generated directory layout when uploading to Steam, itch.io, or your CDN.
Does ChaosProtector slow down my game?
The Godot preset does not virtualize the main engine loop, so its most visible overhead is normally during startup and asset loading rather than every frame. The exact cost depends on the executable, PCK size, storage, and customer hardware. Benchmark startup, loading, and frame times on representative machines before release.
Will my game still run on customer machines?
Protection changes the executable and asset-loading path, so compatibility must be part of release QA. Test the complete generated output on every supported Windows version, storefront, code-signing flow, and antivirus environment used by your audience. Keep the unprotected release and symbols available for diagnosis.
How much does it cost?
ChaosProtector has a Free plan, Basic at $99 one-time, and Pro at $199 one-time. Paid plans include one year of updates and support, and the purchased version remains usable afterward. Godot and advanced protection features vary by plan, so check the pricing page for the current matrix.
What about macOS and Linux builds?
The Godot PCK workflow described on this page targets Windows exports. ChaosProtector also has a separate native Linux ELF64 protection workflow, but that does not imply identical Godot PCK packaging on Linux. macOS Mach-O protection is not currently listed as supported.
From Godot export to protected .exe in 4 steps
No engine source changes or custom engine build are required. ChaosProtector is a post-build step: export normally, protect the resulting binary, and preserve the generated executable, PCK data, and companion-loader layout. Read the step-by-step Godot protection guide for additional packaging and testing context.
Export from Godot
Open your project in the Godot editor. Go to Project → Export, select the Windows Desktop preset, and export your game as usual. Godot's built-in PCK encryption is optional — ChaosProtector adds its own layer on top.
Project → Export → Windows Desktop → Export Project
Download ChaosProtector
Sign in to your Dashboard and grab the ChaosProtector for Godot bundle. It contains the GUI (ChaosProtectorGui.exe) and the CLI, ready to use out of the box. No installer, just unzip and run.
unzip ChaosProtector-Godot.zip -d chaos/
Protect via GUI or CLI
GUI: launch ChaosProtectorGui.exe, click Open File, select your exported mygame.exe. The GUI auto-detects Godot and enables the Godot preset (string encryption, anti-debug, import protection, PCK mutation, integrity check, anti-disassembly). Click Protect.
CLI (for CI/CD pipelines):
ChaosProtector.exe mygame.exe --godot --output mygame.protected.exe
Ship the protected binary
Upload the complete protected output before publishing to Steam, itch.io, GOG, or your own CDN. Keep the generated bin/chaos_loader.windows.x86_64.dllbeside the protected layout when it is emitted, and keep the generated.pdb privately for crash-dump debugging. Run a clean-machine launch test against the exact folder you plan to distribute.
steamcmd +login anonymous +app_build build.vdf +quit
Test protection on your own Godot export
Start with the Free plan, validate the generated build, then compare paid features if you need more layers.
© 2026 ChaosProtector. Tutti i diritti riservati.