Evaluate anti-modding by testing three things: whether it recognises a changed copy of your game in the forms modders actually use, whether your server can act on that signal for the flows that carry value, and whether honest players on genuine installs stay untouched. Otukan checks the running game against the build you published, covering code, assets, native libraries and signing identity, on Android and iOS, including Unity titles. It raises the cost of building and using mods and reports every modded session it recognises to your backend, where inventory, currency and results stay decided by your game server.
The wider picture of cheats and revenue loss is covered on game and revenue protection.
Client exposure
A mod is a copy of your game that someone has changed and redistributed. The change lands in one of four places, and each maps to a different kind of manipulation.
| Where the mod lives | What it manipulates | Typical result | What Otukan checks |
|---|---|---|---|
| Rebuilt package | Execution: patched logic in the shipped code | Unlimited lives, skipped timers, removed ads | Code and package contents against your release |
| Injected library | Execution and state: a menu that toggles cheats in play | God mode, auto-aim, visible enemies | Libraries your release never shipped |
| Edited assets and configs | State: drop rates, prices, level data | Cheaper items, easier levels | Bundled assets and configuration files |
| Paid content switched on locally | Rewards and purchases: unlocks without payment | Premium skins, battle passes, ad-free mode | Integrity of the code that reads entitlements, with ownership held on your server |
Android and iOS differ
On Android, modded packages are shared openly on download sites and installed with a few taps, so rebuilt installers are the main channel. On iOS, a mod usually arrives as a re-signed copy installed through sideloading, or as a library injected on a jailbroken device. Otukan builds its checks for each platform separately, and each signal names the platform it came from.
Unity titles
A Unity game has two layers a modder can target: the native app shell and the engine’s compiled game code and asset bundles. Otukan checks both, so a patched script assembly or an edited asset bundle is recognised as clearly as a changed native library. Engine specifics are covered on Unity app security.
Server authority
A client check tells you what happened on the device. Only the server can make that information stick. For anti-modding, keep these decisions on the backend:
- Entitlements. Whether a player owns premium content is read from your server, never from a flag in the client that a mod can flip.
- Build admission. The server decides which build versions and integrity states may enter ranked play, trading or events.
- Result acceptance. Match results and progression from a session flagged as modded can be held or discarded.
- Account action. Warnings, temporary restrictions and bans are applied and reversed on the server, with the evidence stored alongside.
Otukan sends its integrity result with the session, so your server can admit a genuine build and hold back a modded one before it trusts any claim that client makes. Request-level protection for the same traffic is covered on mobile API protection.
Player experience
Performance
Integrity checks on code and assets do real work, so where they run matters. Otukan places the full check at launch and during loading screens, and lighter checks before protected moments such as match entry or opening the store. Measure launch time and frame time on the oldest devices you support before a protected build goes out.
False positives
Genuine installs change shape legitimately. App stores re-sign builds, Android delivers split packages per device and every update changes your code. Otukan’s integrity reference is built from the release as distributed, so these cases pass. Test each release three ways with Otukan: install a known mod in an authorised lab and confirm the signal, play the same journey on a clean supported device and confirm silence, then repeat install, update, sign-in and your most valuable game mode.
Appeal and recovery
Many players who run a modded copy downloaded it from the wrong site without understanding what it was. Give them a way back: a message that explains the build is not genuine, a link to the official store and a support route that can clear the flag once they reinstall. Keep stronger action for accounts that return with new mods after that.
For the cheat side in depth, see mobile game anti-cheat. Modded clients of streaming and media apps are covered on streaming and media application security. If your game is already live, you can request a free App Exposure Check of the published store release.