How to protect a variable from changing through external programs?

Question

There are many memory-altering programs out there nowadays, just mentioning Cheat Engine. Is there an efficient way of keeping a static variable actually staying static?

I thought of two things to solve this.

1. Making a separate thread which updates the static variable to the fix value, e.g. 200 every minute (yep, that interval would do) Problem: one can also alter this value.
2. Storing the value on the server. Problem: I want to keep the network traffic as low as possible

I need this mechanism for both static variables (ones that never should change at all) and variables that are only allowed to contain a certain range of values, e.g. integers from 100 to 200.

Are there more efficient ways of doing this?

Answer 1

If your game is singleplayer: it's not possible, but you shouldn't care. If you have some online leaderboard, do you really think everyone will cheat? Maybe the top few, but that rarely happens.

If your game is multiplayer: then you should store all your important state on the server, which is much harder to hack than a local machine.

Answer 2

It can't be done, http://security.stackexchange.com/a/4639 is about DRM, but the same applies to anything which the user doesn't want on his computer including Anti-Cheat mechanisms. (Which has the tendency to be even harder to do than DRM.)

But why would you, really why would you? It's your customers computer, not yours, the customer does with his computer whatever he pleases to do with it. You have no rights about it. Your program is removed if the customer doesn't like it.

For multiplayer games it's not about designing the binary running on, but designing the communication. Letting the users just send "I've won with 20000 points" doesn't work, neither does "I've 2000 Gold". You'll need to simulate the game yourself and just let the players send what they are doing like "I ordered the soldier to move to point X/Y" or "I've bought Item number 43", not what the result of that actions are. The server decides what the results are, and who won in the end.

If it is a single player game with online high score, a option would be to have the player send you a replay, simulate it and decide the result from that.

Answer 3

The first is not effective and won't stop any determined person from attacking your game - and it's also error prone. However, you can make it a lot tougher, not full proof, if you would like. Some common strategies are available all over the web but as other people have mentioned - you have to ask yourself if it's worth it.

For arguments sake, here's a couple ways to prevent hacking in a single player environment:

1. Open a handle to every other process on the users machine (invasive and not portable) and over-write their WriteProcessMemory with a dummy function or warning. The choice is yours. This can be defeated because... applications are free to do the same and over-write the handle once again or do things to prevent this.
2. Checksum your application and have it verify itself through a hack shield - this is useful for many permanent edits to your application but won't stop a common memory attack. This can be defeated because... tools like ADA, OllyDbg and even simple hex edits can make permanent patches and changes to your application to remove the offending code - this includes your threaded timer idea!
3. Scan for known hack tools. This also can be defeated by recompiling a tool or attacking your client directly. This can be defeated because... a recompile, rename of the application or change in what your scanner uses as a heuristic will render this useless. Consider using a special portion of memory an application is known to use if you opt for this.

The alternative, of course, is to just store everything on the server and make a game server that is a master. Not only is this expensive, requires upkeep, and increases development time... fans are not so impressed from the implementation of popular games like Diablo III. Or here. I should note for an online flash RPG like Adventure Quest this model has actually been working pretty well for them, however.

I can't provide much guidance on how to implement this type of approach as it's very broad, wide and requires a lot of planning. The basis to know is that the server decides everything and the client is nothing more than a mere input and display console.