Games with unknown release dates and eval

RPG Maker Chat
1

Handling of Games, Save Data, and Materials with Unknown Origins

There was an official announcement a while back.

The reason for creating this topic is to investigate how much plugin authors are considering security.

Games with unknown origins, likely illegally downloaded games or save data. Or perhaps underground sites distributing paid plugins illegally.

The concept of “security” does not exist in the program for Tsukuru MZ. Even experienced plugin authors recklessly use eval, leaving an opening for external attackers.

This is an issue for the entire RPG Tsukuru series, but the cause lies in the trend created by many plugin authors that highly advanced plugins are those that can be customized using JavaScript expressions.

Making plugins with security in mind is tantamount to voluntarily losing in the competition for plugin shares. Development costs increase, and in the meantime, rivals will release their plugins first.

I’ll state this upfront: this is not an attack on specific plugin authors. The most famous plugin author in Japan, Triacon, also uses eval. And users, too, desired such plugins.

There is no solution. At least during the era of Tsukuru MZ, we must keep in mind the existence of this evil function, eval.

For a long time, the problem remained unexposed, but the advancement of AI has changed the situation. It has become easy to create attack programs.

However, there is also a problem with the implementation of Tsukuru MZ, where code mixed with eval can easily infiltrate from save data.

2 Likes
2

I have a bit of a hot take tho. Considering that all RPG Maker games have all of their code open (some with more effort than others, not saying more!), I don’t think it’s impossible for someone to just modify the game, inject some code, and distribute the now malign version of the game, even if you don’t use evals anywhere.

Even with compiled source games this can still be achieved by disassembling the program. Way prior to the existence of AI people have been doing these things.

I’d also consider tampering with save data something you have to actually do by yourself (save data is compressed so at the very least it’s not human-readable by default), or potentially have some kind of malware running?

I think the better solution (and non-solution) is to inform the player to always download the games from trusted sources. I know it’s far from perfect. But educate players about these things is the least we can do.

2 Likes