What are some ways to prevent or reduce cheating in online multiplayer games?

Question

Punkbuster exists just to prevent cheating, and yet cheating is common in punkbuster enabled games. Modern Warefare 2 is seriously locked down from the end user running their own server or making any mods, and cheating happens constantly.

For a multiplayer game where each client is running on a PC, what can be done to reduce or eliminate cheating?

Answer 1

It depends how they're cheating, focusing on one of the primary ways of creating cheats, other processes latching into your application and modifying it - you can enumerate through all other processes, and hook their memory manipulation methods, and their keyboard/mouse emulation methods.

Wallhacks are typically written by injecting code between your process and the DirectX/GL libraries to set the transparency on materials so they can be seen through. You can add some code to your scenegraph/culling system to specifically not draw other players/useful entities if they're behind walls (to prevent cheating that way).

If you're going multiplayer and want to prevent packets being modified between client/server, then creating a checksum of the data you're sending via some algorithm of your own and checking this as it comes through on the other side can be effective. (You will probably end up doing this anyway for various QA purposes).

The same goes for most of your in-memory resources, creating a checksum at the beginning of a frame, and verifying it at various stages can yield in some pretty handy memory manipulation detection.

This is quite an involved topic, but hopefully this sets you in a vaguely acceptable direction.

Answer 2

At the most extreme solution, you basically never trust the client. For games like MMOs, users don't run their servers, and any gameplay logic is handled server side. Never give the client the authority to say "I have X health" or "I have X ammo", etc.

Answer 3

If you've got a system where the logic is expensive and must be done mostly on the client to save server cycles, you can implement a probabilistic cheat detection system. Every few minutes it chooses a different few players to inspect closely and consistency-check on the server. Since cheaters rarely limit their cheating to short and rare periods of time, they will be caught eventually.

Another benefit to this is that they won't have a rapid turnaround cycle for development - if it takes 10 hours of gameplay on average for the server to pay attention to you, then that's a 10-hour turnaround cycle every time you want to see if something worked. And if it did work, it's even longer because they won't know if the server has given them a thumbs-up or just hasn't gotten around to them.

Answer 4

There are also many types of aim-assist hacks for first person shooters that also work by hooking into graphics library calls. OGC Hook for Counter-Strike / HL1 had a multitude of options beyond making walls transparent.

If the location info for enemies is at some point passed to a lower level library which has widely available code, those calls can be hooked into and the location, scale, rotation, etc. data can be used to precisely calculate the best vector for firing upon that enemy. Anti-cheat systems like PunkBuster often include heuristic-type detection (how often does this player get a perfect shot, how often do they spin around 180 degress to land a one-shot kill, etc.) in addition to memory and process monitoring.

Ultimately the task of preventing cheating in multiplayer games is a game of cat and mouse. As new cheats are developed, new anti-cheat methods are created, and then new cheats are built to avoid the new anti-cheat technologies.

As Tetrad said in his response, the only hard and fast rules for "game security" are to provide the client as little information as possible, and to trust the client as little as possible. Different types of games will have different requirements that can impact how well you can adhere to these rules, though.

In an FPS game, because the speed of gameplay is so fast, it is often not possible to only provide the client with data it should know about this exact instant. If you don't tell the client there is an enemy around the corner and the player does go around that corner you suddenly have to send them that information in a matter of milliseconds or risk having the player be killed by an enemy they didn't ever see.

The only "fix" for these issues that is currently available would probably be OnLive. Because that service only delivers audio and video content from a client running safely in the datacenter the only means for cheating would be to essentially create a human AI that could analyse the incoming video stream and take action based upon that -- a task that few, if any, cheaters are up to.

Answer 5

All the answers above are great, but I'll add another piece:

Some games have a very solid replay feature, which allows to save every game's replay after the game's end in a compact format, and watch it in various ways - different player perspectives, real-time statistics UI and so on.

Example that I'm very familiar with: Starcraft 2. One of the ways that Blizzard blocks hackers is by receiving cheating evidence as game replays.

An example for usage in an FPS would be: if you played a game and you suspect that the other person cheated with a wall-hack, you watch the replay, and then see that in his normal replay vision, he couldn't have possibly seen you and throw a grenade over the corner, or whatever.

You then report him with the replay, and if the evidence against him is good enough, he's banned. As far as I know, companies who do this things only take serious evidence, or multiple sources of evidence of the same behavior before banning.

So this is not an anti-debugging technique, it's a user report system that allows convenient human-assisted proof of cheating.

Answer 6

This may not be a full answer, but I have some input here. One of the best ways to prevent cheating is obfuscation or using C/C++. This prevents people from modifying the client code.