Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I'm creating a game on Android where the enforcement of rules can only take place on client side (I can't shift it to server side...think aimbotting but in my case I wouldn't even be able to use heuristics to detect it!).

As I've read many times, the client side is impossible to 100% protect from modification/hacking.

I am going to include protections such as ProGuard obfuscation. But also I'm going to use a formula in the code which encrypts data from the client.

Hackers/cheaters can decompile the code and locate this formula eventually.

But how long will it take for them to uncover the encryption formula? A day, a week? Actually, how long in general does it take for a game to be modded for cheating?

Can I release updates to my game so that by the time hackers release modded versions of my app to public, they become obsolete? If I did release updates, I wouldn't require updates for single player mode, but only when they tried to do multiplayer would a message display telling them they must update.

I just really want to make multiplayer fair and not scare off players because they face opponents with uber-awesome hax.

share|improve this question
2  
"Never trust the client" en.wikipedia.org/wiki/Defensive_programming#Other_techniques –  pwny Jul 22 '13 at 15:30
    
I know of a bunch of online games which rely on the same protection middleware. Said games are patching often, but are almost always hacked again on the same day the patch goes live, or one or two days later. While de.wikipedia.org/wiki/Security_through_obscurity does keep away the script kiddies, it doesn't do much against dedicated individuals with enough knowledge and time. –  sarahm Jul 22 '13 at 16:19
    
Why can't you do validation on the server side? Are clients acting as the server? –  wes Jul 22 '13 at 18:43
    
@wes the nature of the game is kind of like this: for a match between two players the server sends each player in the the game a math equation where they must solve for x. who ever solves the problem fastest gets more points..A hacker could mod the app in a way to receive the input, have some function that instantly solves the math problem, then ping the server saying they solved it, even though they didn't.. –  user1544473 Jul 22 '13 at 19:09
    
Have the player send the XOR of the answer with a magic string to the server when they complete. then it won't matter if they send the correct answer. Clients sending the "correct" answer won't be sending the correct answer at that point. Alternatively, add a salt and hash the answer. If you need to do more than that, consider yourself lucky that you have a successful app and engineer a better solution –  wes Jul 22 '13 at 19:28

1 Answer 1

up vote 4 down vote accepted

But how long will it take for them to uncover the encryption formula? A day, a week? Actually, how long in general does it take for a game to be modded for cheating?

It varies, but could happen within hours of a hacker gaining access to the relevant data. Note that it's possible, in some cases (generally not with indie developers), for this to be before the product actually ships so a hack can be available on launch.

How long it will actually take, in practice, depends. The key factors are

  • how popular your game is (less popular games are less likely to get noticed by hackers interested in them) and
  • how skilled the individuals who do take notice of your game are.

Can I release updates to my game so that by the time hackers release modded versions of my app to public, they become obsolete?

No, this is probably not viable solution for an independent developer. Unless you are significantly changing your protections with every build of the game, a skilled hacker will be able to leverage his or her previous work to easily render a new version of the game vulnerable to tinkering.

Your best bet is shift the confirmation of client-side actions to the server, or at least move verification there. If your system is purely peer-to-peer, you can use a majority-rules form of verification where every peer vets the actions of other peers. You can't trust the client code itself.

share|improve this answer
3  
Frequent updates also means you'd have many of your players in an obsolete state, requiring an update to play. That could easily get annoying if the update process isn't totally transparent. –  Byte56 Jul 22 '13 at 15:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.