Game publishers protect fairness, revenue and proprietary logic by hardening the client where cheats run and letting servers verify what the client claims. Otukan detects memory editors, speed hacks, emulators and modded builds during play, backs purchases and rewards with evidence your servers check, and protects game code in native and Unity layers against extraction and cloning. Your servers stay authoritative over currency, results and bans; Otukan gives them honest input and clear evidence. Scope covers Android and iOS, including Unity titles on both. Other engines are confirmed per enquiry.
Revenue exposure: rewards, purchases and entitlements
Most cheating is ultimately about value. A player who edits a currency counter, replays a reward or forges a purchase takes something your economy was meant to sell. Each path has its own weak point.
| Revenue path | How it is abused | Weak point | Otukan control |
|---|---|---|---|
| In-app purchases | Forged or replayed receipts, patched purchase code | Client reports success without a verified receipt | Attestation on purchase requests, integrity checks |
| Rewarded ads | Reward granted without the ad completing, bots watching ads | Reward logic runs on the device | Automation signals, integrity checks |
| Soft currency and items | Memory editing of balances and inventories | Values held in client memory | Memory editing detection, runtime checks |
| Entitlements and unlocks | Mods that switch on paid content or remove ads | Feature flags inside the client | Anti-modding checks, attestation |
| Ranked play and events | Speed hacks, memory edits, farming bots | Results computed or trusted on the device | Anti-cheat signals, bot detection |
The rule behind the table is simple: anything that grants value should be decided on your servers, and Otukan gives those servers evidence on whether each request comes from an unmodified game played by a person. For cheat detection itself, see mobile game anti-cheat. Evaluating anti-cheat for your game is covered on the mobile anti-cheat solution guide.
Engine scope: native and game-engine layers
Games are built in layers, and an attacker picks the easiest one. Otukan protects each on its own terms.
Native layer
Every game ships as a native Android or iOS app, whatever engine it uses. The native layer loads the engine, talks to the store and holds platform integrations. Otukan protects it with the same runtime checks, integrity checks and obfuscation it applies to any mobile app, and uses Play Integrity and App Attest for server-side proof.
Unity
Unity games carry most of their logic in C#. With the Mono backend, that code ships as managed assemblies that standard tools decompile readily, which makes cloning and patching easy. With IL2CPP, the code is compiled to native, which is harder to read but still open to patching and memory attacks. Otukan protects both: it obfuscates and checks the integrity of game code and assets, and watches the running process for tampering. Framework detail is covered on Unity app security.
Game servers
Your servers hold the truth about balances, inventories, matches and purchases. Otukan feeds them attestation, integrity status and cheat evidence with each relevant request, so server-side rules can distrust a session instead of trusting whatever it reports.
Player experience: performance, false positives and appeals
A security control that frustrates honest players costs more than the cheaters it catches. Otukan is designed around three player-facing checks.
- Performance. Heavier checks run at start-up, match entry and purchase rather than every frame. Start-up time and frame time are measured on your target devices with your own build before release.
- False positives. Rooted phones, custom ROMs and PC emulators are not cheats by themselves. Otukan separates environment signals from active cheat tools, and you choose which modes each one affects. Everything runs silently first, so live-ops sees the effect before any enforcement.
- Appeals. Each flag or ban carries the evidence behind it, in a form your player support team can read. A player who disputes a decision gets a review based on facts, not a guess.
Cloned titles in unofficial stores are a separate revenue drain; for that threat, see fake app protection. Scripted farming is covered on mobile bot detection. Studios with a live title can ask for a free App Exposure Check of the published build.