Game Development Stack Exchange is a question and answer site for professional and independent game developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are many memory-altering programs out there nowadays (Cheat Engine & co). Is there an efficient way to keep a constant variable actually constant?

I had two ideas:

  1. Make a separate thread updating the constant variable to a constant value, e.g. 200 every minute. Problem: One can also alter the second value.
  2. Store the value on the server. Problem: I want to keep the network traffic as low as possible.

I need this mechanism for both constants and variables only allowed to contain a certain range of values.

Are there better ways to do this?

share|improve this question
Neither of those will work. In situation one, the cheater simply has to overwrite the value '200' that you are copying and it is no harder than overwriting the original. In situation 2, the cheater now can change the value without even altering your program simply by changing the bytes received on the network (for example, with a local proxy) – Jimmy Feb 3 '13 at 9:57
I've yet to see a cheat protection that can't be disabled by a hacker. Just be sure you don't make the game a living nightmare for legitimate users, in your crusade against the cheaters :) – user15805 Feb 3 '13 at 10:01
Related; more specific, but otherwise the same. – Anko Feb 3 '13 at 10:50

If your game is singleplayer: it's not possible, but you shouldn't care.

If your game is multiplayer: then you should store all your important state on the server, which is much harder to hack than a local machine.

share|improve this answer
It's very easy to protect against multiplayer cheating by making an authoritative server and only predict state on the client side. Basically, just send player input from the client to the server, not "I did x damage to y". – jmegaffin Feb 3 '13 at 18:16
Indeed @BorealGames, that's what I mean by "store all important state on the server". – jcora Feb 3 '13 at 21:10
Just wanted to clarify a bit :) – jmegaffin Feb 4 '13 at 1:43

It can't be done, is about DRM, but the same applies to anything which the user doesn't want on his computer including Anti-Cheat mechanisms. (Which has the tendency to be even harder to do than DRM.)

But why would you, really why would you? It's your customers computer, not yours, the customer does with his computer whatever he pleases to do with it. You have no rights about it. Your program is removed if the customer doesn't like it.

For multiplayer games it's not about designing the binary running on, but designing the communication. Letting the users just send "I've won with 20000 points" doesn't work, neither does "I've 2000 Gold". You'll need to simulate the game yourself and just let the players send what they are doing like "I ordered the soldier to move to point X/Y" or "I've bought Item number 43", not what the result of that actions are. The server decides what the results are, and who won in the end.

If it is a single player game with online high score, a option would be to have the player send you a replay, simulate it and decide the result from that.

share|improve this answer
Small correction suggestion: The client shouldn't send "I bought item number 43" but instead "I want to buy item number 43". The server should then answer with "OK, you lose 200 GP, you gain one Item43", "No, you don't have enough gold" or "No, the shop you are currently browsing has no item number 43". The server should behave like the game master of a pen&paper RPG. The players say what they want to do, and the server tells them if they succeed. – Philipp Feb 3 '13 at 19:32

The first is not effective and won't stop any determined person from attacking your game - and it's also error prone. However, you can make it a lot tougher, not full proof, if you would like. Some common strategies are available all over the web but as other people have mentioned - you have to ask yourself if it's worth it.

For arguments sake, here's a couple ways to prevent hacking in a single player environment:

  1. Open a handle to every other process on the users machine (invasive and not portable) and over-write their WriteProcessMemory with a dummy function or warning. The choice is yours. This can be defeated because... applications are free to do the same and over-write the handle once again or do things to prevent this.
  2. Checksum your application and have it verify itself through a hack shield - this is useful for many permanent edits to your application but won't stop a common memory attack. This can be defeated because... tools like ADA, OllyDbg and even simple hex edits can make permanent patches and changes to your application to remove the offending code - this includes your threaded timer idea!
  3. Scan for known hack tools. This also can be defeated by recompiling a tool or attacking your client directly. This can be defeated because... a recompile, rename of the application or change in what your scanner uses as a heuristic will render this useless. Consider using a special portion of memory an application is known to use if you opt for this.

The alternative, of course, is to just store everything on the server and make a game server that is a master. Not only is this expensive, requires upkeep, and increases development time... fans are not so impressed from the implementation of popular games like Diablo III. Or here. I should note for an online flash RPG like Adventure Quest this model has actually been working pretty well for them, however.

I can't provide much guidance on how to implement this type of approach as it's very broad, wide and requires a lot of planning. The basis to know is that the server decides everything and the client is nothing more than a mere input and display console.

share|improve this answer

A lot of people use these programs to search for a score stored in a variable e.g

int score = 10;

to do this they need to know the score, ususaly from the score displayed in game.

I was thinking, would this help put them off...

public static float randomVal; // at start of level generate random float

private float 1a3sf5vhh4; //represents score

void hjgkkj4(int val) //add score method
   var 5vhh4 =  1a3sf5vhh4/randomVal+val;
   1a3sf5vhh4 =  5vhh4*randomVal;

then when you need to display score do...

string displayScore = ""+ 1a3sf5vhh4/randomVal;

this will make the cheaters search for what they think is the score( the score being displayed) so they will only find the displayed value.

The real score will be Score*randomVal stored else where. They cant change the score by changing the displayed value.

would this help?

p.s I'm no expert so take it easy on me lol.

share|improve this answer
Just found this vid, makes some interesting – Raimi Nov 26 '14 at 15:05
Cheat tools can be configured to detect such things as well. This just takes more time to track. – Kromster Nov 26 '14 at 21:25
but for a small, offline, single player game, would something like this be an ok solution? looks like it could at least stop a few of the apps out there – Raimi Nov 27 '14 at 15:50
Yeah, that's just the case of EffortSpent vs ProtectionAchieved, where second part can never reach 100%. – Kromster Nov 27 '14 at 17:15

Encrypt the hell out of it! Store important numbers broken up in multiple locations conjoined with other values so that they will constantly change! Use dummy numbers that if altered tells them they are cheaters.

Everything can be cracked, but most wont take the time to do so.

share|improve this answer
...and then your sourcecode will be an unreadable, unmaintainable mess. Good luck finding a bug or making a balance change without blowing the whole thing up. – Philipp Feb 13 '15 at 13:04
If I had to implement this form of cheat prevention, I would be sincerely disappointed if hackers caught on to my evil scheme and just gave up. That would mean I've wasted nobody's time but my own. – Marcks Thomas Feb 13 '15 at 14:08
@MarcksThomas Well if the hackers give up, then you didn't waste your time. That was the goal, after all, wasn't it? – Dan Jan 19 at 14:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.