Game Development Stack Exchange is a question and answer site for professional and independent game developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am almost complete developing a small indie-style multiplayer game. While I intend to allow people to cheat in single-player, this is obviously not acceptable in multi-player. Does anyone know of any ways to help stop the average Joe from using something like Cheat-Engine to modify parts of the game? I currently plan to have the client upload a MD5 hash of each setting file the game uses (stored as an XML) to the game server for verification every few seconds, but is there anything I can do to stop things like memory-editors, etc?

share|improve this question
I would recomend this article, Building Multiplayer Games - Security its written for some multiplayer API, but the ideas are good and still apply – Cyral Aug 9 '12 at 12:03
up vote 4 down vote accepted

If you are worried about locally modified code, then how can you be sure that someone hasn't simply modified your notification code to send a static list of MD5 hashes, the same ones you expect? In fact, you don't even need code modification to do this, you just need a fairly basic proxy (assuming no SSL, but even that could be faked with a bit more effort).

The only way to do what you want is to have a server and simply not trust the client at all. All calculations should be handled on the server and all actions verified as being at least somewhat possible. For instance, don't allow the client to say that they want to move to one side of the map when you know they were on the other side a moment ago. Without a server in the middle doing everything that is vital to the game, it is impossible to not have cheating, because someone smart will always find a way around anything you can build into the client. Even with one, it is still possible if you don't think through all the different ways to manipulate the situation slightly. For instance, the movement validation I mentioned before: If you do a simple point to point calculation people may still be able to teleport through walls.

So the question is, how average is 'average Joe'? You've already mentioned code editing and memory editors. That's above what I would personally consider the average level, and if you do want to be worried about that level then a separate trusted server which does all the heavy lifting is required and the client will boil down to essentially just being display and input devices.

share|improve this answer
Thanks for the help! – Jgolden1 Aug 9 '12 at 9:54
@user185812: It's usually a good idea to wait atleast a few hours before marking an accepted answer. While personally I think my answer's pretty great (I'm biased), other's will likely have more input though and seeing an accepted answer is quite often a deterrent to others to answer. – Matthew Scharley Aug 9 '12 at 10:00
@MatthewScharley - no worries. ;) – Martin Sojka Aug 9 '12 at 10:02

The client is in the hands of the enemy. (The Laws of Online World Design)

Really, the only way to beat most cheats is to have the client be a "thin client", that is: To only act as an input and output device, and to never give it more information than it precisely needs.

This won't stop automation and this won't stop passive information gathering and analysis, but you can design your game such that these don't have a significant impact.

This won't stop people hacking each other via malformed messages relied by the server - your client needs to guard against messages from the server same as you would guard your web sites from SQL injection attacks.

Since you also want to use the same client for the single-player game, a solution would be to run a local server in a separate process/thread and treat it internally as a client/server setting. The "cheats" would then work on the server side. Minecraft does something similar, though it's by no means the first game to split the game engine from its interface in such a way.

Suggested reading:

share|improve this answer

In a basic multiplayer game cheating in the kind of Cheat-Engine simply won't work. The clients are only sending the data and the actions you designed it do to. Usually thats not much more than what the player "did", e.g. in what direction he is running, if he is shooting and so on. So the changes he does to the memory will only affect his own game, but the other players will see no change, a so called desync. Most games detect desyncs like that and remove the desynced player from the game.

Now there are also other ways of cheating, but those are all about how your game is designed.

To protect from the easiest hacks, which is faking network messages, the server should check those package for their sanity. "That guy just jumped 5 screens? Thats impossible, deny package." (Note that you can also go the fully synchronized route -that means everything is synchronized and only "What buttons did the player press."-kind of messages are send- which makes faking network messages useless by design.)

The last way of cheating in multiplayer are visiblity hacks, thats modifying the client so that it shows data to the player which he doesn't know. Examples for this are not showing the fog of war, being able to look through walls, displaying a minimap or other things. These are impossible to prevent.

share|improve this answer
I disagree on the visibility hacks. Couldn't these be prevented by not giving the client information until their character would be aware of it? Don't get me wrong, this may not be good design. But that's different from being impossible to prevent. – xuincherguixe Aug 10 '12 at 5:02
@xuincherguixe I think it is impossible in some circumstances. For example both clients are playing under the same IP and the same port. In such case it is only a client's good will that prevents him from reading data meant for the other one. – Wodzu Jan 13 '13 at 12:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.