By some estimates, the Cocos engine holds around 20% of the global games market. Its strength is 2D rendering, which makes it a natural fit for small and mid-sized titles. But Cocos is open source, and that openness has made it an especially popular target for crackers.
A Cocos game keeps its main resources and code in the package’s assets/ directory. Take JavaScript as an example: those assets live in .JSC files. Since the files can’t simply be opened and compiled, a cracker instead digs through the engine’s startup project for libcocos2djs.so — which is where the key is stored.
The libcocos2djs.so file holds the Cocos key
From there, they load the .so file into a disassembler like IDA, search for applicationDidFinishLaunching, and lift the key. Compile that key back in, and the resource and code files are theirs.
Using IDA to locate the Cocos engine key
Cocos also supports a second scripting language: Lua. Compared with JavaScript, Lua is better suited to non-HTML5 games — and it carries just as serious a cracking risk.
Because Lua is interpreted, the Lua VM can execute source directly, which tempts many developers to ship raw Lua source right inside the APK or IPA. That’s effectively leaking your game’s source code: it lowers the barrier to building cheats and opens the door to competitors copying the game outright.
Some studios reach for LuaJIT or custom Lua builds, but against a professional decompiler, even those often aren’t enough.
The luadec decompiler
Resource files are among a game’s most valuable assets — they hold images, code, audio, and video, and in Cocos, the Lua files especially. A single leak can set off a chain of problems: competitors cloning the game, intellectual-property damage, spoiled content, and tampered resources repackaged into cheats for sale.
So encrypting the Cocos engine effectively — and raising the bar for would-be crackers — has become required homework for game studios. To address everything above, JikGuard has built a protection scheme designed specifically for Cocos:
Engine module hardening —An industry-first, import-free SO packer hardens the engine module, shielding game code from analysis and blocking a cracker’s next move.JavaScript encryption —Encrypts JS scripts with a high-strength algorithm and guards against hook-based cracking.
C++ encryption —Hardens the compiled C dynamic library against decompilation.
Lua encryption —Applies deep encryption so Lua scripts can’t be decrypted directly; supports ulua, tolua, slua, and xlua, and hardens the Lua parsing module as well.
Resource encryption —A specially built scheme that encrypts only the core, critical points, with next to no impact on load times or runtime.
Anti-cheat —Beyond encryption, adds behavior detection plus anti–memory editor, anti-debugging, anti-injection, and anti–speed hack protection.
Anti-crack —JikGuard’s proprietary “signature-free API validation” works from the ground up, encrypting the engine and code and running multiple checks on package signature and file integrity — blocking injected modules, ad stripping, and the like.
On top of that, JikGuard’s Cocos protection brings a few more advantages:
Low overhead —A pure native solution: the security modules are written in C++ for efficiency, and the crypto uses private obfuscation to keep overhead to a minimum.Cross-platform with hot updates —Works across Android, iOS, PC, and H5. with support for online hot-updating of resources.
Easy to integrate —Dead simple to use — a single command-line run encrypts the entire game’s resources.
