Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

For browser games and those on a mobile phones, it's common to have a global highscore table. It's also common for those tables to contain scores of 2,147,483,647 - where people have figured out the webservice call that's used to report the player's final score, and have used that to record fictitious scores.

For simple puzzle games we can record every move the player made (and any random seeds used to generate the level) and send that as part of the score-reporting call. The entire game can then be reproduced and verified on the server.

However, for anything above the scale of Pac-man this becomes infeasible.

What other techniques are there to prevent cheating of this kind?

share|improve this question
I had this exact same question regarding iPhone games using the same technique to create a global highscore table. –  deft_code Sep 30 '10 at 14:53
Are you sure it would be infeasible to send the replay? –  Lohoris Feb 15 '12 at 8:34
Yes I am sure. :) –  teedyay Feb 15 '12 at 10:09
add comment

9 Answers

up vote 9 down vote accepted

For our game Moblox, we use at first our internal system (now it is OpenFeint): - we send a JSON message on HTTP (not HTTPS). In this message, we made a md5 on all fields plus a magic string and add it in the message; - on server, we check the integrity of the message with the same operation;

To crack the system, you must find this key (the magic string). It is possible with reverse engineering. But, it's painful.

OpenFeint, ScoreLoop and CocosLive uses the same trick with HTTPS. Very easy to implement.

share|improve this answer
I'm quite dubious that reverse engineering to find your magic string would be all that difficult. –  Kylotan Oct 1 '10 at 10:46
This is an Android Application in native C++. There is no symbol, nor good debugger available. So you can read the ARM code, but not trace it easily. The key is composed by multiple operations so find all strings is not sufficient. That is not perfect but quite painful. –  Ellis Oct 1 '10 at 18:18
A standard undergraduate exercise, at least in US universities, is to reverse-engineer passwords constructed as you describe, by reading y86 (cgi2.cs.rpi.edu/~hollingd/comporg-spring2007/notes/Y86/…) assembly code. –  user744 Oct 6 '10 at 12:49
Yes, i know it. In france, we do the same in few engineering schools. It is the same problem as copy protection. It it not the perfect solution. But in many cases, it is sufficient. My opinion because i made just little games. –  Ellis Oct 6 '10 at 17:06
This is a terribly weak technique, which will give to the developers a very false sense of security. –  Lohoris Feb 15 '12 at 8:33
show 1 more comment

While you're right that it's not always feasible to send entire replays to the server for complex games, a similar system can be used by having the server periodically (and semi-randomly) ask the client for some part of its state, while the game is running.

For example, in an FPS, every minute you could ask "How many kills do you have?", "Where are all the enemies?", etc. If the client doesn't come back with a reasonable answer to a challenge in a reasonable amount of time, they are cheating.

Of course, this only works if the game is online during the entire play session. Since the goal here is to be able to upload to an online leaderboard, I think that's reasonable - don't kick the player out of the game if they answer wrong, just don't let them on the score list.

I would encourage you to reconsider sending replays however. All you really need is the initial random seed and timestamped input. This should really be a few hundred KB at most. Many arcade games do this already to save replays for player review purposes; having your server validate these might not be trivial, but it prevents all kinds of cheating except botting.

share|improve this answer
add comment

You can limit the most flagrant of abuses by monitoring the highest results in the top score table. Depending on your game, you may have a "perfect score," above which any score must be fraudulent. If not, you can calculate the lowest "impossible score;" can the player shoot 10 shots per second, the game lasts 1 minute, and each killed enemy is worth 100 points? Then any score higher than 60,000 must be fraudulent.

You can also help mitigate the problem by sending along some metadata; not the full game history, as you describe, but just the components that make up the score. Say: score 60000, 500 enemies killed, and one bonus item grabbed. You can then perform simple checks. This is "security through obscurity," and therefore not secure at all, but it helps eliminate the most naive of attackers.

share|improve this answer
You can also flag a user (possibly by IP) if they submit a score that doesn't match the metadata. Then if they try and submit a score again that DOES have correct metadata, you can scrutinise it, and possibly just ban them altogether. You could also send a cheeky message back from there submit score request :) –  Adam Harte Oct 3 '10 at 19:27
I think this answer is better than the accepted answer. Just figure out which number is the maximum your players can achieve. Anything higher, just discard. –  Sergio Oct 5 '10 at 16:16
So if one player who goes to a university cheats, everyone on the network is now a "cheater" –  AttackingHobo Oct 5 '10 at 20:54
add comment

I added a quick/dirty high score table to a project of mine a while back and not being at all versed in internet security/etc it turned out sort of flawed. Surprisingly, with nearly 1,200,000 recorded scores, I've only had maybe 5 or 6 occasions of batches of blatantly incorrect scores reaching the top of the board. Most of the scores even looked more like a glitch in the game, than a true "hacking".

So I guess an important point is: make sure your game's scoring system is airtight, or at least do some really good score feasibility checking; now, this game I'm talking about was a Ludum Dare 48hr entry, so it wasn't the most stable thing around.. but on the whole I think it's often more likely that the casual player will discover/exploit an ingame glitch than having someone directly "hack" the leaderboard.

That said, I'm working on a rewrite of this project right now, and I'm going all out with the obfuscation. I won't go into too much detail, but I basically have all scores submit a key value based on a bunch of random values and hashing and a magic string, then any score that passes that check and is high enough to make the actual "Top X" leaderboard has to pass another round of validation (this time with an expiring key value generated on the server end, and more thorough feasibility checks).

I'd also advise using a packet tracer of some sort to test out what sort of things are visible (I was originally doing a much simpler verification that meant someone could use a packet tracer to find and duplicate an uploaded score's http request, without knowing the magic string or anything (meant you needed a legit score first, but you could send duplicates of that score as much as you wanted..)). I used Wireshark for testing this.

Huh, this turned out a bit long, but hopefully it helps...

share|improve this answer
Certainly is. Looks like a salted hash is a good way to go. I hadn't considered that they'd resend the same valid score many times. A GUID and a timestamp included in the packet (and in the hash) should put paid to that - I can check for dupes on the server. Thank you. –  teedyay Sep 30 '10 at 21:25
add comment

Ultimately you can only rule out impossibly high scores, because the rest are (by definition) merely implausible, and thus might be a legitimate (and awesome) player.

Otherwise you have to rely on obfuscation techniques (such as encryption, and sending other stats beyond just score).

You could also send the score periodically as the game is being played, which would add another level of complexity to cheating - i.e. the server can decide if the game has been played long enough to warrant a particular score, and also ensure that enough intermediate reports were received during the play-time (just don't make it 100% or the train going into a tunnel on my way home will result in my throwing the phone out the window).

Ultimately someone will find a way to break it though, so don't kill yourself trying to stop them.

share|improve this answer
add comment

I am not an expert in this field but if I were you, I will try to encrypt the score with an key embedded in the your code. Those people will need to apply reverse engineering over your code instead of the plain text used for the web-services.

share|improve this answer
I'd go even one further. Generate a hash from the code by hashing the exe file (or part of it). When sending scores send the version number and the server can validate using a table that has simple constants version number->hash code. Then you get the added bonus that if someone cheats by modifying the program, his high score wouldn't count. –  configurator Sep 30 '10 at 21:31
If someone is modifying the program, they can already send whatever key they want. –  user744 Sep 30 '10 at 22:06
@Joe Wreschnig, they can send any key they want, but the server should be set to only accept valid keys. –  AttackingHobo Oct 5 '10 at 20:55
I think Joe's point was that they don't have to use the hash of the newly modified program, but can just send whatever the previous hash was. –  Kylotan Oct 6 '10 at 10:26
@Kylotan: hash a timestamp too –  gd1 Sep 26 '11 at 4:56
show 2 more comments

Speedruns are basically recording of every keystroke, and they are recording about a WHOLE game. So, yes, you can record the whole game, it's not unfeasible. Any other way to do that is crackable through reverse engineering (I can't stress it enough: you're not adding security, you're adding obscurity).

Still, even if you do it this way they could actually submit a speedrun. You can do nothing to prevent that.

share|improve this answer
Usually the playback, not the recording, is the part that is infeasible for the server. If the client's been playing the game for a couple hours, the server-side resimulation could take many CPU-minutes or worse. That's not really acceptable if you have a lot of people submitting scores. –  user744 Oct 1 '10 at 0:11
The size of the data packet would become an issue for mobile games - especially if the player pays for their bandwidth by the byte. –  teedyay Oct 1 '10 at 8:13
Oh, what both of you say is true. Still, there's no other "real" solution. –  Lohoris Oct 1 '10 at 9:31
You don't have to validate every recording submitted, you just have to validate the ones that make it to the top 10. There's not much point cheating to become #11. And you don't have to do it in realtime. Periodic batch process would be fine. –  gray Oct 6 '10 at 7:21
add comment

While you're at it, there's the question of whether a high score is simply a player who found an exploit (for example, if some things in the game give a score penalty, and a bug causes a negative score to "wrap around" to become highly positive... or just a player who finds a certain game condition like a safe spot on the board where they can just sit there and not have to worry about losing, indefinitely).

In order to tell the difference between a hack and a game exploit, uploading at least some play data would be good. It'll help you fix the exploits, at least.

For some games (particularly turn-based ones), you can actually have the game played through the server, where all of the game logic exists on the server side and the client is just an interface. This not only makes score hacking a lot harder, but it also enables you to log all player actions on the server trivially, and thus replay any game at any time. I realize for something like a twitch action shooter, this might be impractical.

share|improve this answer
add comment

Never implemented this before but...

Send scores incrementally with timestamps. This gives you a log to see how often the score improved as well as a way to trace the highscore's "momentum".

You would then set milestones/criteria for your scores.

For example: A score greater than 20,000 can not arrive in first 20secs of a game. An score greater than 250,000 can not arrive without an entry greater than 200,000.

This is not exactly the same as sending a game state, but close to it.

Side Benefit: Think of all the useful game play statistics you would get from this. Someone would prob pay good money for that.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.