V2 code virtualization protects a narrow set of critical gameplay logic in shipping client builds by moving selected native routines into custom bytecode artifacts that are loaded by the protected runtime. The scope is intentionally small: drive and meter economy, super/fatal-blow activation gates, finisher resolution, and match-state finisher routing.
Protected Segments#
The protected segment list lives in
V2/ue/Build/DRM/v2-code-virtualization.json. Each segment names the owning
module, source file, protected symbols, bytecode output, symbol map, runtime
allowlist, deterministic simulation parity fixture, and rollback parity fixture.
The plan uses V2CodeVM-BC-v1 as the custom bytecode evidence format. It does
not add a VM implementation in this repository; the manifest and planner define
the release contract that a protected build tool must satisfy.
Boundaries#
This layer is for critical gameplay logic only. It is shipping-client-only and must stay out of editor, debug, and dedicated-server builds. Protected client paths still require server-authoritative revalidation.
The virtualization plan must preserve deterministic simulation parity and rollback parity. Every protected segment needs a fixture proving that protected and unprotected builds produce the same gameplay result for the same input.
This layer has no anti-debugging, process scanning, driver inspection, or hidden runtime enforcement. Those are separate tasks with their own review gates.
CI Gates#
V2/ue/Tools/plan-v2-code-virtualization.py emits the deterministic code
virtualization plan. V2/ue/Tools/check-v2-code-virtualization.py validates the
manifest, source-symbol coverage, planner output, runtime unpacker dependency,
Horde wiring, CI workflow wiring, and this runbook.
Required release gates:
drm-code-virtualization-plan-generateddrm-code-virtualization-segment-coveragedrm-code-virtualization-bytecode-outputdrm-code-virtualization-determinism-fixturesdrm-code-virtualization-runtime-allowlist
The gates ensure every protected segment has custom bytecode output, source symbol maps, deterministic simulation parity, rollback parity, and runtime allowlists before a protected client build can ship.