Hot answers tagged anti-cheat
23
The way you have it described, somebody hacking a save file would just need to construct an MD5 hash of the save file values in order to bypass this measure. You need to add one thing in order for this to even really be worthwhile: a secret block of arbitrary data that's added to what you're hashing (both when creating the save and when validating it on ...
16
It depends how they're cheating, focusing on one of the primary ways of creating cheats, other processes latching into your application and modifying it - you can enumerate through all other processes, and hook their memory manipulation methods, and their keyboard/mouse emulation methods.
Wallhacks are typically written by injecting code between your ...
15
You can't stop memory editing cheats, so design your game so that such cheats won't matter. For an online game, sensitive data like money on your own server, and don't rely on the client to have the correct amount. That way it won't matter if players change the amount of money displayed on the client, because when the player purchases stuff the game checks ...
14
Unfortunately it's really hard to stop people from cheating, which is why software like Punkbuster was created to try to catch some of them.
For an MMO, the biggest thing you can do is to just not trust anything the client sends you. The client should not be able to tell you where the player has moved to, how much damage they have dealt to whom, etc. ...
14
Simple ways to protect your game:
Duplicate your data: store some information twice and compare the copies. If they are different, something is going wrong. You don't have to do it per variable, you can also make CRC's on some big areas of memory (ex: on a struct that contains all player information).
Encrypt your data before its written to memory (and ...
14
Think you're lagging now? Just wait 'till you have to get real-time occlusion information from the server. Now you can walk around from behind a wall and bad guys will suddenly pop into view as the server catches up and sends you the updated occlusion data.
So my snarky comment tells it all. Likely the primary reason not to do this is lag and server load. ...
12
Another possibility (for integer values) is to have a second member-variable which holds a bitwise complement of an existing variable.
So imagine you got health, you would also have healthComplement. Your implementation could look like this:
// setter sets value and complement
void setHealth(int value){
health = value;
healthComplement = ~value;
}
...
12
There are a few different ways to handle this, and many solutions have their own merits. I will give my opinion of the ideal way to handle this.
First, it's important to understand that no matter how complicated your system is, someone who is sufficiently invested in gaming the system (with appropriate knowledge) will figure out a way to game it.
To ...
10
Being able to decompile/reverse engineer the client code easily is really only a slight hindrance. Enterprising hackers have been bending executables to their will (maliciously and non-) for years before high-level, trivial-to-decompile languages like C# came on to the scene. Security through obscurity alone is no security at all.
Any data on the user's ...
10
It's doable, and has been tried in research before; for a comparison of interest management schemes, see http://dl.acm.org/citation.cfm?id=1230069
As Byte56 said, it may require more CPU, but it may reduce your bandwidth, and reduce the likelihood of wall-hacks.
And as Byte56 said, an interest area strictly limited to the player's occlusion-area may ...
9
While you're right that it's not always feasible to send entire replays to the server for complex games, a similar system can be used by having the server periodically (and semi-randomly) ask the client for some part of its state, while the game is running.
For example, in an FPS, every minute you could ask "How many kills do you have?", "Where are all the ...
9
If this is not an online tracked competitive type game:
Let em hack away man. You can spend way too much energy on things like this when people who will play the game, will just play the game. Those who want to hack it will never really want to play it, they just want to hack it.
If it is an online competitive type game:
All you have to do is store the ...
9
The basic idea is trust. Who can you trust? Nobody. So, don't. Don't let the users decide anything, everything that requires trust happens on the server.
Items only "exist" on the server. Money only "exists" on the server. The clients can do requests (like "I'd like to sell item X"), the server sees who owns what, and thus you can't sell something you don't ...
8
Here's one scheme I came up with when someone was asking for it on some board long ago. Using percentages or doubled variables doesn't really work, as you can search for "any" values and freeze them.
Instead, make a monster of a data type.
Basically, store your important values as a structure with:
32 pointers to bits
For quick reading, have the struct ...
8
For our game Moblox, we use at first our internal system (now it is OpenFeint):
- we send a JSON message on HTTP (not HTTPS). In this message, we made a md5 on all fields plus a magic string and add it in the message;
- on server, we check the integrity of the message with the same operation;
To crack the system, you must find this key (the magic string). ...
7
If you've got a system where the logic is expensive and must be done mostly on the client to save server cycles, you can implement a probabilistic cheat detection system. Every few minutes it chooses a different few players to inspect closely and consistency-check on the server. Since cheaters rarely limit their cheating to short and rare periods of time, ...
7
You can limit the most flagrant of abuses by monitoring the highest results in the top score table. Depending on your game, you may have a "perfect score," above which any score must be fraudulent. If not, you can calculate the lowest "impossible score;" can the player shoot 10 shots per second, the game lasts 1 minute, and each killed enemy is worth 100 ...
7
The client is in the hands of the enemy. (The Laws of Online World Design)
Really, the only way to beat most cheats is to have the client be a "thin client", that is: To only act as an input and output device, and to never give it more information than it precisely needs.
This won't stop automation and this won't stop passive information gathering and ...
6
How about you store the health complemented with a random value generated each time you store it. This would at least defeat the simple mechanism of searching for increasing/decreasing values in memory to find the health.
class Player
{
int m_Health;
int m_RandomHealth;
Random m_Rnd = new Random();
public int Health {
get
{
return ...
6
I added a quick/dirty high score table to a project of mine a while back and not being at all versed in internet security/etc it turned out sort of flawed. Surprisingly, with nearly 1,200,000 recorded scores, I've only had maybe 5 or 6 occasions of batches of blatantly incorrect scores reaching the top of the board. Most of the scores even looked more like a ...
6
The simplest and most effective way to counter 'farming' of scores is to adjust the score received based on the disparity between the players. Bear in mind it's not just one player creating multiple accounts you need to worry about: imagine two friends, one deliberately losing so the others ranking is artificially boosted.
Chess and other games avoid this ...
6
You could award points based on the difference between the opponents' point totals. Very good players would earn few points for defeating newbies, and newbies would earn many points for defeating experienced players. Likewise, losers would lose points proportional to the same scale.
This wouldn't completely solve your problem, but it would eliminate the ...
6
I suppose you could have the server send a hash of it's executable to an authentication server, to ensure it hasn't been modified been modified, but that's about it.
I wouldn't worry too much about it, if you're going to let players have their own servers let them do whatever they want with the game, they purchased it. You can make it difficult to cheat, ...
5
I've found this is much easier to fix through game design than through enforcement/banning. Even if you permanently ban all of a player's accounts, sufficiently determined players can find a way around your ban (e.g. if you track IP, they can use dynamic IP or IP masking).
For example, if you award points to players for winning PvP contests, you give ...
5
There are also many types of aim-assist hacks for first person shooters that also work by hooking into graphics library calls. OGC Hook for Counter-Strike / HL1 had a multitude of options beyond making walls transparent.
If the location info for enemies is at some point passed to a lower level library which has widely available code, those calls can be ...
5
The people over at https://panopticlick.eff.org/ did some testing on how somebody could be uniquely identified by several values that can be gathered from almost any browser. The results are astounding and you could use a similar approach (maybe combined with other measures) to identify and track your users.
5
If this is for hack prevention, it's a losing battle.
Things like hashes and sending random bits of data back to the server for validation come to mind, but nothing stops the hacker from using a separate, non-compromised copy of the original data as source for answering such checks.
Same goes for sending checksums of in-memory resources.
One way might be ...
4
One possible option I think might work (I'm not too familiar with these cheating tools): don't hide it. Perform your operations and expect certain results. After the operation (possibly next frame), check to ensure that the results are as you expect them to be. If you subtract health and then verify it, only to find health never changed, you can be pretty ...
4
Although I made the first comment questioning the point of degrading the experience of a portion of your audience for no apparent gain, I still find it an interesting question from a technical point of view.
I just had this idea: What cheaters do is find values that change and freeze them. The search would then happen only between deaths or events that ...
4
Ultimately you can only rule out impossibly high scores, because the rest are (by definition) merely implausible, and thus might be a legitimate (and awesome) player.
Otherwise you have to rely on obfuscation techniques (such as encryption, and sending other stats beyond just score).
You could also send the score periodically as the game is being played, ...
Only top voted, non community-wiki answers of a minimum length are eligible
