API Reference

OZeroSecurityManager OZeroSDK.Security

The central singleton that manages all active security modules. Survives scene transitions via DontDestroyOnLoad. Access it through the static Instance property. Created automatically by OZeroBootstrapper at one of three [RuntimeInitializeOnLoadMethod] hooks before the first scene loads — do not instantiate it manually.

Properties

Methods

Registers a third-party callback on the user chain. The built-in default handler runs on a separate chain and cannot be silenced by unregistering user callbacks. The callback receives an OZeroSecurityEvent containing the module type, public abort code, message key, safe diagnostic message, and whether the current policy will terminate the app.

Removes a previously registered user callback. Always call this in OnDisable or OnDestroy to prevent memory leaks.

Delegate

The callback signature used by RegisterUserCallback. Read evt.Type, evt.AbortCodeHex, evt.MessageKey, evt.Message, and evt.WillAbort to decide your own UI, logging, or save-flow response.

Example

using OZeroSDK.Security;
using UnityEngine;

public class MySecurityListener : MonoBehaviour
{
    void OnEnable()
        => OZeroSecurityManager.Instance.RegisterUserCallback(OnThreat);

    void OnDisable()
        => OZeroSecurityManager.Instance.UnregisterUserCallback(OnThreat);

    void OnThreat(OZeroSecurityEvent evt)
        => Debug.Log(
            $"Threat={evt.Type}, Code={evt.AbortCodeHex}, Message={evt.Message}");
}

OZeroSecurityEvent class

Customer-facing violation payload passed to RegisterUserCallback. It intentionally exposes stable, safe diagnostics rather than internal detection details.

ModulationType enum

Identifies which security module raised an alert. Available as OZeroSecurityEvent.Type.

OZeroBootstrapper OZeroSDK.Security

Zero-wiring auto-bootstrap entry point. You do not call anything on this class directly. It connects the SDK to Unity startup, loads the verified security configuration, and prepares enabled detectors automatically before gameplay starts. Native runtime protection is also initialized here when available.

OZeroSecurityConfigRuntime OZeroSDK.Security

Runtime loader for the protected build-time security configuration. It validates the packaged configuration, prepares an in-memory OZeroSecurityConfig snapshot, and applies the configured threat-response policy if validation fails.

Properties

Methods

Idempotent loader — safe to call repeatedly. First access validates and loads the packaged configuration; later calls reuse the same snapshot. Failure handling follows the configured global threat-response policy.

OZero Secure Variables OZeroSDK.Security

Encrypted drop-in replacements for primitive types. Values are stored exclusively in the Native C++ heap and encrypted with OZero proprietary cipher. A per-frame per-frame masking layer is applied on top, so memory scanners see only noise. All arithmetic operators and implicit conversions are supported — existing code requires only a type name change.

Available types

Supported operators

Numeric types (Int, Int64, UInt, UInt64, Short, UShort, Byte, Float, Double, Decimal) support all arithmetic (+ - * / %), comparison (== != < > <= >=), compound assignment (+= -= *= /=), and increment/decrement (++ --) operators, plus implicit conversions to/from their primitive equivalent. Vector2 and Vector3 support arithmetic and equality operators. Bool supports equality operators only. String supports ==, !=, and +. Buffer provides raw byte-array access with index operators.

OZeroSafePlayerPrefs OZeroSDK.Security

An encrypted drop-in replacement for Unity's PlayerPrefs. Key names are hashed with message authentication and values are encrypted with OZero proprietary cipher using a device-bound encryption key. The stored data cannot be read by browsing the device's registry (Windows) or preference plist (iOS).

Methods

All methods are functionally identical to their PlayerPrefs counterparts. No migration step is required — simply replace the class name.

OZeroSV_File OZeroSDK.Security

Encrypts and decrypts files with built-in integrity verification. Keys live at the app level (not device-bound), making the format compatible with Steam Cloud Save. On read, the integrity check runs before the data is returned; tampering causes an exception rather than silently returning corrupted data.

Methods

Encrypts contents and writes the protected payload (header + ciphertext + authentication tag) to path. The directory must already exist.

Reads the file at path, verifies its integrity, and returns the decrypted string. Throws InvalidDataException if the file has been tampered with.

Encrypts a raw byte array and writes it to path.

Reads and decrypts a file written by WriteAllBytes. Verifies the integrity tag before returning.

Example

using OZeroSDK.Security;

string path = Application.persistentDataPath + "/save.json";
string json = JsonUtility.ToJson(saveData);

// Write (encrypts automatically)
OZeroSV_File.WriteAllText(path, json);

// Read (decrypts + integrity check)
try
{
    string loaded = OZeroSV_File.ReadAllText(path);
    saveData = JsonUtility.FromJson<SaveData>(loaded);
}
catch (System.IO.InvalidDataException)
{
    // File was tampered — handle accordingly
    Debug.LogError("Save file integrity check failed.");
}

OZeroBuildIntegrityValidator OZeroSDK.Security

Runtime validator for build tampering, debugger/timing anomalies, platform-native integrity checks, and optional Pro server attestation. The component is created automatically by OZeroBootstrapper when Build Integrity is enabled in OZeroSecurityConfig.

What it checks

Public properties

Events and methods

Invoked when all enabled local checks pass.

Invoked when an enabled local check or Pro attestation rejects the build.

Invoked after Pro server attestation succeeds and AttestationToken contains a valid token.

Starts a manual validation run. Normal projects usually rely on the dashboard's startup and periodic validation settings instead.

OZeroSpeedHackDetector OZeroSDK.Security

Detects speed hacks and time manipulation using five independent detection signals. A threat is reported only when signals confirm each other, reducing false positives.

Detection signals

Detection fires via OZeroSecurityManager callbacks with ModulationType.SpeedHack or ModulationType.TimeHack. Configured in OZeroSecurityConfig.

OZeroInjectionDetector OZeroSDK.Security

Observes abnormal runtime module, hook, debugger, and trusted-module policy signals. Periodic checks use jittered scheduling where applicable to reduce predictable scan timing.

What it detects

Detection fires via OZeroSecurityManager callbacks with ModulationType.Injection.

OZeroSecurityConfig ScriptableObject

A ScriptableObject asset that stores global security settings. Author it in the Editor, then let the build pipeline package a protected runtime configuration for player builds. Access the effective settings through OZeroSecurityConfig.Instance.

Fields

Fields are grouped into nested settings classes (Response, Integrity, InstallSource, DeviceBinding, SpeedHack, Injection) accessed via the matching property on OZeroSecurityConfig.Instance. The most commonly tuned fields are listed below — see the inspector tooltips on the asset for the full set.

OZeroLicenseConfig OZeroSDK.Security.License

ScriptableObject loaded from Resources/OZeroLicenseConfig. It selects the license tier, stores the Plus/Pro license key, and enables optional Pro runtime features. Missing or empty config behaves as Standard/serverless mode.

Fields

Useful properties

Loads the runtime config from Resources. Treat null as Standard/serverless mode.

True for Standard, Plus, or an empty license key. False only when Pro activation should run.

True for Plus and Pro. Used by the build preflight and native Variant binding.

OZeroLicenseRuntime OZeroSDK.Security.License

Runtime facade for the current license state. It is initialized automatically at app startup, so most projects only read its state or call HasCapability.

Properties

Methods

Idempotent startup method. Usually called automatically by the SDK; custom bootstraps may await it before reading license state.

Returns whether the active entitlement includes a capability such as telemetry, signed_time, or attestation_v1. Returns false in Standard/serverless mode.

License Server Runtime Calls

Pro features use HTTPS JSON calls under /v1. These calls are issued by the SDK automatically; game code normally interacts through OZeroLicenseRuntime and module settings instead of calling the endpoints directly.

OZeroAbortCode & Event Messages

When a confirmed security violation occurs, the SDK creates an OZeroSecurityEvent. The event contains a ModulationType, a stable public OZeroAbortCode, a MessageKey, a safe English Message, and WillAbort.

Abort code and message table

Treat OZeroAbortCode and MessageKey as stable public values for logs and localization. The human-readable Message is intentionally safe and may be shown in developer UI.

Handling abort events at runtime

Register a handler with OZeroSecurityManager.RegisterUserCallback if you need to flush an analytics queue, show a developer-facing warning, or persist a graceful save before the SDK aborts. Check evt.WillAbort to know whether the current response policy will terminate the app.

using OZeroSDK.Security;

void OnEnable()
{
    OZeroSecurityManager.Instance.RegisterUserCallback(OnHack);
}

void OnHack(OZeroSecurityEvent evt)
{
    Debug.LogWarning(
        $"OZero: {evt.Type} {evt.AbortCodeHex} {evt.MessageKey} - {evt.Message}");

    if (evt.WillAbort)
    {
        // Last chance to flush your own analytics or save state.
    }

    Analytics.FlushSync();
}

Injection Detector API OZeroSDK.Security

Programmatic surface for the hash + signer-fingerprint whitelist. Use OZeroDispatch at runtime and OZeroLicenseConfig to seed trusted entries shipped with your game.

DTO — OZeroInjectionWhitelistEntry

[Serializable]
public class OZeroInjectionWhitelistEntry
{
    // SHA-256 of the matched module file. Lowercase 64-char hex. Required.
    public string HashHex { get; set; }

    // SHA-256 of the module's signing certificate. Lowercase 64-char hex.
    // Empty ("") means "match by hash only" (only mode for Android .so / Linux ELF).
    public string SignerHex { get; set; }

    // Module file format hint — "pe" | "macho" | "so". Defaults to "so".
    public string Type { get; set; }

    // Optional human-readable note (UI / audit only — never sent to native).
    public string Comment { get; set; }
}

Use this DTO when you need to seed locally trusted module entries from Unity. Pro customers usually manage the same policy from the portal.

Runtime API — OZeroDispatch

// Returns true when trusted-module policy support is available.
public static bool HasInjectionV3 { get; }

// Replace trusted module entries atomically. Pass null/empty to clear.
// Returns false when the runtime support is unavailable.
public static bool RegisterInjectionWhitelistHash(OZeroInjectionWhitelistEntry[] entries);

// Trusted-module aware scan. Returns true when a relevant runtime signal is observed.
// Output fields are diagnostic context for your review and may be empty.
public static bool DetectAssemblyInjectionV3(
    out bool   silencedByWhitelist,
    out string hashHex,
    out string signerHex,
    out string matchedModulePath);

All three are static helpers. Treat them as optional capability surfaces: check availability first and keep local trusted entries minimal.

Config — OZeroLicenseConfig

// Inspector array of OZeroInjectionWhitelistEntry — preferred surface.
public OZeroInjectionWhitelistEntry[] InjectionWhitelistEntries { get; }

public string[] InjectionWhitelistKeywords { get; }

InjectionWhitelistEntries is the local seed for trusted module policy. Use it only for modules you intentionally ship or explicitly trust.