Application security feature

Memory editing detection

Otukan notices when coins, health, timers or scores are rewritten in a running Android or iOS game, and tells your server which values can no longer be trusted.

  • Android
  • iOS
  • Unity
Edited coins and stats is met at the value checks boundary before it reaches the appEdited coins and statsValue checksYour app
  • The editor is seen

    Otukan detects memory scanners and editors that attach to the game process or read its memory through the operating system.

  • Changed values are caught

    Values you mark are held in a checked form, so a number rewritten outside your game's own code fails verification when it is next used.

  • Server resets the state

    The server learns which value class was touched, and can restore balances or void a match from its own record.

Memory edits Otukan recognises

Choose an edit to see how Otukan finds it, what the game does and what reaches your server.

Search-and-replace scans

  1. Detect

    Otukan recognises memory scanners working on the game process while they narrow down where a value such as gold or ammunition lives.

  2. Respond

    The game can alter or hide the marked value's layout for the session, which breaks the scanner's search.

  3. Report

    A scanning signal reaches your server before any edited value is submitted.

Rewritten counters

  1. Detect

    A marked value that changes without passing through the game's own code no longer matches its check, and Otukan flags it.

  2. Respond

    The game falls back to the last verified value, or ends the session, per your policy.

  3. Report

    Your server is told which value class failed, such as currency or health.

Frozen values

  1. Detect

    Otukan notices when a value the game should change, such as a cooldown or a stamina bar, is pinned by an outside tool.

  2. Respond

    Competitive and reward-bearing modes can be restricted for that session.

  3. Report

    The freeze is reported with the mode and build it happened in.

Editors on modified systems

  1. Detect

    Platform-specific checks find the root access or jailbreak most memory editors depend on, and virtual containers used to run a game beside an editor on Android.

  2. Respond

    Casual play continues while ranked and trading modes wait for a clean environment.

  3. Report

    An environment signal lets your server weigh other results from that device.

Debugger-driven edits

  1. Detect

    Otukan detects a debugger or tracer attached to the release build to pause the game and write memory directly.

  2. Respond

    The game stops the protected flow before the edited state is used.

  3. Report

    A debugging signal travels with the session so the server discards its results.

Neighbouring controls for in-memory data

Detecting edits works together with controls that keep values unreadable and environments trustworthy.

  • Memory protection

    Keeps tokens, keys and decrypted records readable only while they are in use, so a memory dump yields little.

  • Anti-debugging

    Detects a debugger stepping through release code, the tool behind the most precise memory writes.

  • Android root detection

    Recognises devices where root access lets one app read and write another app's memory.

  • iOS jailbreak detection

    Recognises jailbroken iPhones and iPads, where injected tweaks can change a game's values from inside its process.

You choose the response

Set a response for each user flow. Start by observing, then tighten flow by flow as the signals prove themselves.

Observe

Signal sent to your backend

Rolling out a new policy and measuring real-world signals.

Warn

This device looks modified. Continue with care.

Conditions some genuine users create, such as developer settings.

Restrict

Payments are unavailable on this device.

Payments, stored data and account changes.

Terminate

Session closed for your security.

Clear tampering on a high-risk flow.

How memory editing detection is set up

  1. Pick the values

    Choose the numbers whose change costs you money, fairness or progression.

  2. Trace their life

    Map where each value is created, updated, displayed and synchronised with the server.

  3. Mark and protect

    Marked values are checked at use, inside your existing build and release pipeline.

  4. Baseline real play

    Record how checks behave on clean devices across your supported range before enforcing.

  5. Enforce per mode

    Ranked, trading and reward modes move to stricter responses first.

Free for app publishers

Check your app's exposure

A passive review of your published app by an Otukan engineer. No files, no access to your systems. Findings go by email to the verified publisher.

You finish the request on the next page.

Evaluate memory editing detection by naming the values in your game that matter, following each through its life in memory, and testing whether an edit is caught before the value is used or sent to your server. Otukan detects memory scanners, editors and debuggers working on a running game, and checks the values you mark at the moment they are read. On Android and iOS, including Unity titles, it reports which value class was touched so your server can restore state or void a result. Your server keeps the ledger for currency and inventory; Otukan tells it when a client’s numbers can no longer be trusted.

For the full set of game controls, see game and revenue protection.

Exposure

Memory editors are among the oldest cheat tools, because they need no knowledge of your code. A player searches for the number on screen, changes it in the game, searches again and repeats until one address is left. Then they write the value they want.

ValueWhere it lives while playingWhat an edit doesWho loses
Soft currencyCached balance shown in the shop and HUDUnlimited purchases in-gameYour economy and paying players
Health, damage, ammunitionCombat state computed on the deviceInvincibility and one-hit winsOpponents in competitive modes
Cooldowns and timersCountdown values the client ticks downSkipped waits that players would otherwise pay to skipYour revenue
Scores and progressTotals built up during a run before submissionLeaderboard entries no one earnedEvery honest player on the board
Loaded buffersLevel data and item stats read from filesWeaker enemies, stronger dropsBalance and live-ops plans

Each row names a transient value: it exists in readable form only while the game runs. That is the exposure memory editing detection addresses.

Lifetime

Mapping each value’s lifetime shows where checks belong and where a plaintext number cannot be avoided.

Creation

A value appears when the game loads it from the server, from a save or from game data. From this moment Otukan holds a marked value in a checked form.

Use

Every read by your game’s code confirms the value still matches its check. A value that an outside tool rewrote fails at this step and triggers your response.

Display and computation

To draw a number on screen or run combat maths, the game needs the plain number for a moment. That boundary is unavoidable, and editors aim for it. Otukan narrows the window and watches for the tools that exploit it.

Synchronisation and cleanup

When the value is sent to your server, the session’s memory signals go with it. When the run or match ends, marked values are cleared, and the next session starts from the server’s record.

Where editors get their access

On Android, most memory editors need root access or run your game inside a virtual container next to the editor. On iOS they usually depend on a jailbreak or an injected library. Memory reading and editing in iOS apps more widely is covered on iOS app memory protection. Otukan builds these environment checks separately for each platform.

Validation

A memory editing control is only as good as its test. Run three passes with Otukan on each protected release:

  1. Positive test. On an authorised rooted Android device and an authorised jailbroken iOS device, change a marked value with a memory editor and confirm the expected signal and response.
  2. Negative control. Play the same journey on clean supported devices and confirm that no check fires, including during heavy scenes where the game updates values quickly.
  3. Regression. Repeat install, update, sign-in and your most valuable mode, and record OS versions, devices, results and the reviewer.

Also record a legitimate runtime baseline: how often each check fires on clean devices during long sessions, backgrounding and resuming, low-memory conditions and the fastest scenes in your game. That baseline is what lets you enforce with confidence, because it shows the quiet state you expect from honest players and makes a real edit stand out.

Keep one mistake out of the test plan: encrypted save files or encrypted storage do not prove anything about memory. A value can be encrypted on disk and still sit as a plain number in memory while the game runs. Test the running game.

Protecting secrets rather than game values in memory is covered on mobile app memory protection. For how signals feed a cheat verdict, see mobile game anti-cheat.

Common questions

  • Is memory editing detection the same as encrypting save data?

    No. Encrypting data on storage protects it while the game is closed. Once the game loads a value to use it, the value lives in memory, and that is where editors work. Otukan detects tools that scan or write memory and checks marked values at the moment they are used. Save-file protection and memory checks answer different attacks and belong in the same plan.

  • Should we mark every variable in the game?

    No. Checking values has a cost, and most variables carry no value to a cheater. Mark the few that decide money, fairness or progression: soft and hard currency, health and damage in competitive modes, cooldowns, timers and scores submitted to your server. A short list, checked well, protects more than a long one that slows the game.

  • Can the server not simply validate the values?

    It should, where it can. A server that owns the currency ledger does not need to trust the client's number. Many games still compute combat, physics or timers on the device for responsiveness, and there the server only sees the outcome. Otukan tells the server when that outcome came from a session with edited memory.

  • Does this work for Unity games?

    Yes. Unity games hold their state in the engine's managed memory or in compiled native code, depending on the scripting backend. Otukan detects editors attached to the process on Android and iOS and checks the values you mark with either backend. Tell us which one your title ships with and we will walk your team through the setup for it.

On the mobile engineering team?

How protection fits your build, signing and release, platform by platform.

Know when your numbers were changed

Tell us the platforms, the engine and the in-memory values that decide progress or money in your game, such as currency, cooldowns or match scores. Source code, builds, signing keys and player records stay with you; we never request them.

Or request a technical demo