Unity teams protect game logic and runtime behaviour in two places at once. On the device, Otukan hardens the code your build produces, whether Mono or IL2CPP, and detects memory editors, speed tools, hooks and modified clients while the game runs. On your servers, the decisions that carry real value stay authoritative, and Otukan’s signals tell them which clients to trust. Otukan protects Unity games on Android and iOS. Client protection makes cheating slower, costlier and visible; it does not replace server-side validation of currency, results and purchases. The sections below cover build variants, the client-server boundary and performance.
Build variants
Scripting backends
Unity compiles C# in one of two ways, and the release contents differ sharply.
With Mono, your game code ships as .NET assemblies such as Assembly-CSharp.dll, which standard decompilers turn back into readable C#. .NET MAUI apps ship managed assemblies too; .NET MAUI app security covers those release builds. On Android, Mono cannot target 64-bit ARM, so releases that must meet Google Play’s 64-bit requirement use IL2CPP.
With IL2CPP, Unity converts your code to C++ and compiles it to native machine code. On iOS, IL2CPP is the only backend. The native code is harder to read, but the build also ships global-metadata.dat, which maps functions back to class, method and field names. Otukan protects that metadata and hardens the native code around it.
Native components and content
Every Unity game also carries the engine’s native libraries, your native plugins, third-party SDKs for ads, analytics or payments, and content in asset bundles or Addressables. Otukan’s integrity checks cover the game code, metadata and native libraries, and detect modified content your policy cares about.
| Component | Android | iOS | What Otukan adds |
|---|---|---|---|
| Game code (IL2CPP) | libil2cpp.so per ABI | Inside UnityFramework.framework | Native hardening and integrity checks |
| Metadata (IL2CPP) | global-metadata.dat in the package assets | global-metadata.dat in the app bundle | Metadata protection |
| Game code (Mono) | Assemblies in the package | Not available | Assembly hardening |
| Engine and plugins | Native libraries and AARs | Frameworks | Integrity checks; runtime checks tuned for SDKs |
| Content | Asset bundles, Addressables | Asset bundles, Addressables | Modification detection |
Security boundary
What the client defends
On the device, Otukan detects the tools behind common mobile cheats: memory scanners that rewrite currency or health, speed tools that accelerate timers, hooks that change what game functions return, and modded clients. It also identifies emulators and automated input. The response is yours per flow: observe, warn, restrict the feature, or end the session. For cheat types in detail, see mobile game anti-cheat.
What the server decides
Anything with lasting value belongs on the server: balances, inventory, match outcomes, leaderboard entries and purchase validation against the store’s own server APIs. Otukan attaches client integrity evidence to those requests. The server can then reject impossible results, hold rewards for review, or match flagged players separately, without banning anyone on a single signal.
| Decision | Client role | Server role |
|---|---|---|
| Match result | Detects memory editing and hooks during play | Validates the result against game rules |
| Currency and rewards | Detects value tampering and speed tools | Holds the balance and grants rewards |
| In-app purchase | Adds integrity evidence to the request | Validates the receipt with the store |
| Ranked access | Flags emulators and automated input | Applies matchmaking rules |
The wider sector picture is covered on mobile game security.
Performance
Start-up and frame timing
Players notice hitches before they notice anything else. Otukan schedules runtime checks to respect your frame budget, keeping them off the render loop’s critical path. Measure a protected build against a baseline from the same commit: cold start, time to first interactive scene, and frame-time distribution in your heaviest scene, on the low-end and mid-range devices your players really use.
Crash diagnosis
IL2CPP crash reports need native symbols: the symbols package Unity produces for Android and the dSYMs for UnityFramework on iOS. Otukan keeps both valid for protected builds, so your crash tool reads them as before. Force a crash in a protected build on each platform to confirm it. How to measure a protected build is covered on mobile app protection performance.
For how games fit Otukan’s wider protection model, return to mobile app security. A published game can start with a free App Exposure Check of its store build.