Tell me more ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.
up vote 3 down vote favorite
1

In a client server game architecture, what are the possible ways to verify that the client has not modified things like gfx assets or client side scripts?

Obviously no solution is perfect, but I would love to hear some ideas.

I am thinking something like an hash on all the files in the resources directory. Does that sound feasible?

share|improve this question
1  
If you need automatic updates, your 'launcher' could check the integrity of client files and update any files differing : two birds with one stone, though probably not a great solution. The other problem is that any integrity checks would mean you have to recalculate the client-side hash which could take a while :/. – Jonathan Connell Oct 12 '11 at 8:21
2  
As Jari Komppa said, you are going to fight your customer. You should better to try to cooperate with them (especially if they pay you). Try to ride eventual creative derivatives putting the artwork to the judgment (including blame) of your user community. – FxIII Oct 12 '11 at 12:58

2 Answers

up vote 5 down vote accepted

If this is for hack prevention, it's a losing battle.

Things like hashes and sending random bits of data back to the server for validation come to mind, but nothing stops the hacker from using a separate, non-compromised copy of the original data as source for answering such checks.

Same goes for sending checksums of in-memory resources.

One way might be to send screenshots or checksums thereof, but then you hit the problem of different video cards/drivers rendering subtly different frames...

All that said, I'd consider outsourcing the problem to someone who has been doing it for a while, like http://www.evenbalance.com/ (punkbuster).

share|improve this answer
+1 for outsourcing. Punk buster has thousands of man years experience in this. – Jonathan Dickinson Oct 12 '11 at 22:20
up vote 1 down vote

There's no way to reliably protect an engine that is executing on a computer you don't control, but you can make it a lot harder to cheat, for example by encrypting resources and communications traffic. Also, no one trying to hack your system will be able to do it perfectly the first time. Put in some tripwires to detect attempts to hack and permanantly ban any accounts that are caught.

share|improve this answer
Using the VAC delay system will also deter hack writers - they may release a fully working hack only to find that a day later their account is banned. It makes black-box debugging that much harder. – Jonathan Dickinson Oct 12 '11 at 22:22
-1 for suggesting encryption: in these context, it will almost always give the developers a very false sense of security. – Lohoris Feb 29 '12 at 13:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.