Obfuz obfuscates Unity code and tries to get the edge cases right for you

An obfuscator sold on Unity integration

Obfuz describes itself as an open-source, powerful and easy to use solution for Unity code obfuscation and hardening, and it is aimed squarely at commercial game projects, which the Chinese README states as the requirement it aims to satisfy. The interesting claim is not that it obfuscates, but how little you have to configure to make it work in a Unity project. The README says it is deeply integrated with the Unity workflow, handling automatically all the cases that need special treatment except reflection, for example names such as a MonoBehaviour that cannot be renamed, and it works well with no obfuscation rules configured at all by default. Integration is also claimed to be fast, with only the assemblies you want obfuscated needing to be listed. For a plugin whose job is to break your own build in subtle ways, that is the feature that matters most.

The technique list, read as a threat model

The feature list is worth reading as a set of answers to specific questions an attacker might ask. Against structure analysis there is polymorphic DLL output, a custom randomised file format where the DLL structure differs on every release, and obfuscation polymorphism, where different generation keys and randomisation seeds produce different obfuscated code. Against static analysis of your logic there is constant obfuscation for int, long, float, double, string and array constants, expression obfuscation for common operations such as add and sub, function call obfuscation that scrambles call structure, and control flow obfuscation that flattens the flow. Against dynamic analysis there is variable memory encryption, execution stack obfuscation, a randomised encryption virtual machine, and a combination of static and dynamic decryption so the code cannot be read offline. The list also includes code watermarking for traceability.

Hot update and DOTS decide whether it is usable at all

For a live service game, obfuscation that breaks the hot update path is worse than no obfuscation, so the compatibility list here is what makes the plugin viable. Obfuz states that it supports the most popular hot update schemes, naming HybridCLR and xLua, and that it is fully compatible with those frameworks so dynamic code updates keep working. It also states that it is compatible with the various versions of DOTS and works with no configuration required. The backend matters as well, since the project supports both the il2cpp and the Mono backends. The platform statement is broad, covering all platforms that Unity and the Tuanjie engine support, with Unity 2019 and later as the floor, and the Tuanjie engine itself supported. A plugin that has to keep working across a hot update, a scripting backend and a data oriented framework at once is solving a much harder problem than renaming symbols.

Junk code is aimed at the store review process

One feature stands out because it is not really about protection. Junk code generation supports several kinds of junk code and is described as improving the chance of passing App Store and Google Play review. That is a different goal from defeating a reverse engineer, and it is worth separating the two when you evaluate the tool. Padding a build to look more like a normal application and padding a build to slow down a cracker are separate objectives, and the README lists them together. The code watermark feature has a third purpose again, traceability, which is a compliance and attribution concern rather than a security one. None of the three is unreasonable for a commercial release, but they are not interchangeable, and a project that only wants symbol renaming will be paying for a lot it does not need.

It installs as a Unity package, not a build step

The distribution mechanism is the standard Unity one, and the manifest shows the shape of it. The package identifier is `com.code-philosophy.obfuz`, the version is `4.0.0`, the display name is Obfuz, the category is Scripting, and the author is Code Philosophy:

{
  "name": "com.code-philosophy.obfuz",
  "version": "4.0.0",
  "displayName": "Obfuz",
  "description": "Obfuz is an open-source Unity code obfuscation tool designed to provide Unity developers with a powerful, secure, and user-friendly code protection solution.",
  "category": "Scripting",

The repository is laid out the way a Unity package expects, with an `Editor/` directory for the editor side, a `Runtime/` directory for the code that ships in the build, a `Plugins/` directory, and a `package.json` at the root, each with its companion `.meta` file. There is no separate build server component and no external tool to install. Documentation lives on obfuz.com with a quick start page, and a separate `obfuz-samples` repository holds the example projects. The Chinese and English READMEs are both in the root, and there is a Gitee mirror alongside GitHub for contributors in China.

Testing, support channels and the roadmap

The stability claim is specific. The README says there is a comprehensive automated test project that passes more than 3000 test cases covering almost all common code cases, and it attributes the agility of the project to responding quickly to developer requests, fixing bugs promptly and following the latest Unity and Tuanjie engine changes. For a tool that rewrites your code, that test suite is the product, because the failure mode is a build that compiles but behaves differently. The support channels are broad for a small project. You can open an issue on GitHub, email the maintainer at the address given in the README, join the QQ group, or use the Discord channel, and the project asks for all kinds of contributions. The roadmap lists two items still to come: anti memory dump and anti debugging, to prevent memory dumping and debugging behaviour, and code virtualisation, which converts code into virtualised instructions for the highest level of protection.

Licence, and the reflection question you have to answer yourself

The licence is MIT, and the README states plainly that Obfuz is released under it with free use, modification and distribution. For a commercial game studio, that removes the usual objection to obfuscation tooling, since most commercial obfuscators are licensed per seat and per title. The one thing the project does not solve for you is reflection, and the README says so directly. Names that the engine or your own code look up at runtime cannot be renamed, so a project that uses reflection has to declare those members and exclude them, which reduces the coverage you get and creates a list of places where an attacker knows what to look at. That is a real trade-off and it is a configuration task, not a tool defect. The other honest caveat is the roadmap, since anti debugging and code virtualisation are the two features that would move this from a reasonable baseline to a serious barrier, and neither has shipped yet.

Editorial conclusion

Adopt Obfuz when you ship a Unity game and need obfuscation that survives the engine's own constraints, since the project states that it handles everything that needs special treatment except reflection, and it works with both the IL2CPP and Mono backends and with hot update frameworks. Do not adopt it as a general purpose .NET obfuscator, since it is built as a Unity package with an Editor workflow and Unity 2019 or later as the floor. Verify first how your project uses reflection and whether your hot update solution, HybridCLR or xLua, is covered by the configuration you intend to use, and check the store review angle around junk code before enabling it.

Frequently asked questions

Official sources

1. focus-creative-games/obfuz on GitHub
2. Issues
3. License: MIT
4. Project website
5. README