ysoserial.net VS Aetheria-Economy

Any unchecked deserialization is dangerous - as you can see in this repo the same attack works on Json.NET, since you can inject a payload that performs arbitrary remote code execution.

So if you have some type within your application that does something sensitive or disruptive in its constructor, an attacker can craft a stream of bytes that asks the application to create that type. From there, all kinds of crazy things can happen. Here's a privilege escalation exploit discovered in Docker for Windows that relied on BinaryFormatter. Digging into some things he mentioned I found an entire exploit suite for .NET serialization. Through very clever tricks, it creates types that, when deserialized, will execute commands. That's a big deal.

The required driver script will be helpful in figuring out what it's doing. Happy spelunking!

We had a bit of a hiatus after it became clear that we'd never get a publisher deal since the game is open source, and we're now pivoting into a narrative-focused vertical slice "demo", which we're hoping we can use to grow an audience and crowdfund.

The license you purchase on the asset store to use those assets does not permit you to redistribute them. This means that you need to approach the creators individually and acquire special permission to include their asset in your repo, even if you're not relicensing it. Very few asset store devs will agree to this, I can tell you from experience.

Here's ours.

The game is open source, so if you're up to it you can check out the code for it in the meanwhile here. It's not exactly plug and play, though!

I'm using dual serialization for the heavily polymorphic data structures in my game - MessagePack with integer keys and union polymorphism for the wire format and local storage, and Json.NET with string keys and JsonKnownTypes polymorphism for debug output and long term persistence in RethinkDB. Here's what one of my simpler polymorphic data structures looks like. Lots of attributes but that's the price you pay I guess.

Our project could certainly use some more code hands on deck! There's 8 of us so far, and we're building a rogue-lite third person space shooter with a story centered around a time loop. Here's a trailer. Here's our Github (it's open source!). Here's our Discord. I'm PixelBro#3202 btw.

If you're using Unity I'd like to recommend my open source game as a potential study candidate. Here's the repo, trailer of the game and a pitch deck if you wanna know more.

By the way, Aetheria: Terminus is an open source project! You can find the code for the galaxy generation right here.

Meanwhile my whole studio is developing our (unique and amazing) game completely open source, and I'm still not worried in the slightest about IP theft. Anyone with the ability to comprehend our codebase has much better things to do than "steal" our ideas, and mechanics aren't copyrightable anyway.