Code Protection in Unreal Mods: Why Stripping Sources Does Not Protect Them

Killing Floor inherited from Unreal Tournament both its modding model and an old argument: should a modder be able to hide their UnrealScript? The Unreal Wiki page "Trystan/Code Protection" collected that debate in the early 2000s with Trystan, Mychaeel, El Muerte, Foxpaw, Solid Snake, Xian and others. The arguments still apply to KF mutators, ServerPerks forks and stripped server packages. This page summarises them and draws practical conclusions.

How Unreal packages store code

A compiled .u holds two separate things:

• bytecode, which the engine executes;
• the source text of each class, stored as plain text next to it, only so editors and exporters can show it.

"Protecting" a package means removing the second part, for example with ucc editor.stripsourcecommandlet. The bytecode stays, because the game needs it. Tools such as UT Package Tool, WOTgreal and later UE Explorer turn bytecode back into working, if uglier, UnrealScript. See UE Explorer cleanup notes and UT Package Tool walk-through.

The original complaint

Trystan's point was not that code must be hidden. It was about double standards:

• When a coder asks how to protect their code, the community piles on: "Epic owns it anyway", "the EULA gives it to everyone", "it can't be protected, so it was meant to be shared", "you learned from us, so share back".
• When someone asks how to get code out of a protected package, people just explain how, without a word about copyright or asking the author.

He rebutted the common claims. Copyright stays with whoever wrote the code; the EULA does not hand mod code to Epic or to the public; "it can't be protected" says nothing about permission; learning from a community does not oblige you to publish everything. His request: answer both questions honestly, and when explaining extraction, add that the code is someone's work and was probably protected for a reason.

The case against stripping

Mychaeel's answer became the main counter-argument:

• It protects nothing. A thief still recompiles the bytecode, or even places your actor from your package directly into their map. Only the people who wanted to learn lose.
• It removes the very thing worth reading: structure, comments, the author's name and licence header.
• It sends a wrong signal: that packages with source left in are free to take. People who do not strip get hurt by those who do.
• Low barriers discourage the worst people. Some treat a technical lock as a challenge and consider breaking it a licence to use what was behind it.

Licences and credit

What the thread suggested instead of stripping:

• A licence in the source. El Muerte released his work under the GPL, which requires derived works to keep the source open. Others used a short header: "contact X before reusing" or "free to use as long as...". Put an email address there too.
• Survive decompilation. spoon pointed out that a LICENSE file in a zip does not travel with a decompiled package. His fix: a License.uc class that is one big comment, referenced from every class header.
• Pick the licence carefully. It was debated whether the GPL even fits mods, which run inside a proprietary engine like libraries; the LGPL was suggested as an alternative. A licence also does not stop someone claiming your code; it gives you grounds and the community a clear rule.

Obfuscation and the anti-cheat exception

Foxpaw and others discussed scrambling code: meaningless names, dummy functions and parameters. Mychaeel's reply: that stops people understanding the code, not using it, and decompiled bytecode is already hard to read. In Deus Ex, the anti-cheat mod DXMTL went further, and a tool called ModProtector later reused its trick: it fills the name table with non-printing characters, so UTPT shows only squares.

Xian, an anti-cheat author, made the strongest case for hiding code. When every check is readable, cheat makers know exactly what to bypass, and one public bypass tutorial produces a dozen cheats. For anti-cheat and admin-security code, obfuscation buys time, even if it never fully protects.

When code does get stolen

MadNad (Excessive) and El Muerte (ServerAdds) described real thefts: a mod recompiled under another name, a readme with the author removed. What actually helped was the community: other players and sites called it out and restored the credit. El Muerte's view: the Unreal modding scene works like open source, people help each other as long as you return the favour.

Practical rules for Killing Floor modders

• Reading code to learn is fine. Copying it into your release without asking is not. Most authors will say yes if you email them.
• Credit and keep the licence header in anything derived from someone else's code, including decompiled code.
• If you release a mutator, ship the source or at least do not strip it. KF servers live for years, authors leave, and an unstripped package is the only way someone can fix it later.
• If you need protection (anti-cheat, admin tools), accept that stripping and obfuscation only slow people down. Keep sensitive logic on the server, where clients never receive it.
• Rename packages you modify so they do not clash with the original on servers and in clients' caches.

How Killing Floor server owners did it

On the killingfloor.ru forum in 2011, scar described how to "protect" a ServerPerks mutator: after compiling, run from System

ucc Editor.StripSourceCommandlet YourPackageName.u
pause

Keep your project's source first: it cannot be recovered from the "protected" package. Flame checked that editor.stripsourcecommandlet and editor.stripsource are two spellings of the same commandlet with the same result. LLIePLLIeHb pointed out the practical downside: a stripped package breaks compilation of other mutators that extend it, so it has to be removed from EditPackages and everything around it rebuilt. Opinions in the thread split the same way as in the debate above: some welcomed the protection, others called it a blow to KF modding.