Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

There are many memory-altering programs out there nowadays (Cheat Engine & co). Is there an efficient way to keep a constant variable actually constant?

I had two ideas:

  1. Make a separate thread updating the constant variable to a constant value, e.g. 200 every minute. Problem: One can also alter the second value.
  2. Store the value on the server. Problem: I want to keep the network traffic as low as possible.

I need this mechanism for both constants and variables only allowed to contain a certain range of values.

Are there better ways to do this?

share|improve this question
    
Neither of those will work. In situation one, the cheater simply has to overwrite the value '200' that you are copying and it is no harder than overwriting the original. In situation 2, the cheater now can change the value without even altering your program simply by changing the bytes received on the network (for example, with a local proxy) –  Jimmy Feb 3 '13 at 9:57
4  
I've yet to see a cheat protection that can't be disabled by a hacker. Just be sure you don't make the game a living nightmare for legitimate users, in your crusade against the cheaters :) –  Alex M. Feb 3 '13 at 10:01
    
Related; more specific, but otherwise the same. –  Anko Feb 3 '13 at 10:50

4 Answers 4

If your game is singleplayer: it's not possible, but you shouldn't care.

If your game is multiplayer: then you should store all your important state on the server, which is much harder to hack than a local machine.

share|improve this answer
3  
It's very easy to protect against multiplayer cheating by making an authoritative server and only predict state on the client side. Basically, just send player input from the client to the server, not "I did x damage to y". –  Boreal Feb 3 '13 at 18:16
    
Indeed @BorealGames, that's what I mean by "store all important state on the server". –  jco Feb 3 '13 at 21:10
    
Just wanted to clarify a bit :) –  Boreal Feb 4 '13 at 1:43

It can't be done, http://security.stackexchange.com/a/4639 is about DRM, but the same applies to anything which the user doesn't want on his computer including Anti-Cheat mechanisms. (Which has the tendency to be even harder to do than DRM.)

But why would you, really why would you? It's your customers computer, not yours, the customer does with his computer whatever he pleases to do with it. You have no rights about it. Your program is removed if the customer doesn't like it.

For multiplayer games it's not about designing the binary running on, but designing the communication. Letting the users just send "I've won with 20000 points" doesn't work, neither does "I've 2000 Gold". You'll need to simulate the game yourself and just let the players send what they are doing like "I ordered the soldier to move to point X/Y" or "I've bought Item number 43", not what the result of that actions are. The server decides what the results are, and who won in the end.

If it is a single player game with online high score, a option would be to have the player send you a replay, simulate it and decide the result from that.

share|improve this answer
6  
Small correction suggestion: The client shouldn't send "I bought item number 43" but instead "I want to buy item number 43". The server should then answer with "OK, you lose 200 GP, you gain one Item43", "No, you don't have enough gold" or "No, the shop you are currently browsing has no item number 43". The server should behave like the game master of a pen&paper RPG. The players say what they want to do, and the server tells them if they succeed. –  Philipp Feb 3 '13 at 19:32

The first is not effective and won't stop any determined person from attacking your game - and it's also error prone. However, you can make it a lot tougher, not full proof, if you would like. Some common strategies are available all over the web but as other people have mentioned - you have to ask yourself if it's worth it.

For arguments sake, here's a couple ways to prevent hacking in a single player environment:

  1. Open a handle to every other process on the users machine (invasive and not portable) and over-write their WriteProcessMemory with a dummy function or warning. The choice is yours. This can be defeated because... applications are free to do the same and over-write the handle once again or do things to prevent this.
  2. Checksum your application and have it verify itself through a hack shield - this is useful for many permanent edits to your application but won't stop a common memory attack. This can be defeated because... tools like ADA, OllyDbg and even simple hex edits can make permanent patches and changes to your application to remove the offending code - this includes your threaded timer idea!
  3. Scan for known hack tools. This also can be defeated by recompiling a tool or attacking your client directly. This can be defeated because... a recompile, rename of the application or change in what your scanner uses as a heuristic will render this useless. Consider using a special portion of memory an application is known to use if you opt for this.

The alternative, of course, is to just store everything on the server and make a game server that is a master. Not only is this expensive, requires upkeep, and increases development time... fans are not so impressed from the implementation of popular games like Diablo III. Or here. I should note for an online flash RPG like Adventure Quest this model has actually been working pretty well for them, however.

I can't provide much guidance on how to implement this type of approach as it's very broad, wide and requires a lot of planning. The basis to know is that the server decides everything and the client is nothing more than a mere input and display console.

share|improve this answer

A lot of people use these programs to search for a score stored in a variable e.g

int score = 10;

to do this they need to know the score, ususaly from the score displayed in game.

I was thinking, would this help put them off...

public static float randomVal; // at start of level generate random float

private float 1a3sf5vhh4; //represents score

void hjgkkj4(int val) //add score method
{
   var 5vhh4 =  1a3sf5vhh4/randomVal+val;
   1a3sf5vhh4 =  5vhh4*randomVal;
}

then when you need to display score do...

string displayScore = ""+ 1a3sf5vhh4/randomVal;

this will make the cheaters search for what they think is the score( the score being displayed) so they will only find the displayed value.

The real score will be Score*randomVal stored else where. They cant change the score by changing the displayed value.

would this help?

p.s I'm no expert so take it easy on me lol.

share|improve this answer
    
Just found this vid, makes some interesting points...youtube.com/watch?v=G25YhoE04Xc –  Raimi 23 hours ago
    
Cheat tools can be configured to detect such things as well. This just takes more time to track. –  Krom Stern 17 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.