2
\$\begingroup\$

I am working on a simple game. It will have multiplayer over LAN, and I want to give the host the option to verify that players are not using modified clients (note that this will be disabled by default; this is more of a coding exercise). Both the client and host are identical.

Here's what I have so far:

1.) The host generates a random key.

2.) The host takes this key, combines it with the host IP address, and uses it to salt an MD5 hash of the important game files.

3.) The host then takes the generated key, and sends it in a packet to the client.

4.) The client takes this key, combines it the originating IP address of the packet, and uses it to salt an MD5 hash of the important game files.

5.) The client takes the hash and sends it back to the host.

6.) The host then checks the hash it receives from the client against the hash it generated. If they are unequal, it drops the connection.

Is this sufficient to deter most client modifications? I get that this check can be circumvented by using an unmodified client to generate the hash and sending it with a modified client; is there any way to prevent this?

Improve this question
\$\endgroup\$
4
  • \$\begingroup\$ How do you find, on host, whats its IP address as seen by client? It is not a trivial thing. Also note java code can be altered in runtime (remember debugging your game?). \$\endgroup\$ – wondra Mar 22 '18 at 20:38
  • \$\begingroup\$ @wondra Since it's over LAN, it should be pretty easy to find the local IP address, right? Also, if the code is altered in the runtime, won't the hash change as well? I could just do this check every 5 minutes or so. \$\endgroup\$ – Johnny Mar 22 '18 at 20:54
  • \$\begingroup\$ Your method mey be useful to detect important game files integrity rather than the client application itself (I guess you want to check it out too). \$\endgroup\$ – liggiorgio Mar 22 '18 at 21:03
  • \$\begingroup\$ Yes, especially if there is just one network interface on each station. Remember you would be hashing the original files not what is actually loaded in memory. But then again, if somebody is capable of that, he would probably be able to turn the check off completely. \$\endgroup\$ – wondra Mar 22 '18 at 21:03
3
\$\begingroup\$

I get that this check can be circumvented by using an unmodified client to generate the hash and sending it with a modified client.

So you've handed every player the exact recipe for how to lie to you.

Is this sufficient to deter most client modifications?

For the exact reason you stated above, no. Every single player has the means to falsify this check.

If you want to absolutely stamp out modified clients, then you can't trust the client to tell the truth about anything you ask it, not even "what are the contents of your game files?"

Instead, you need to create a system in which a player cannot gain advantage by modifying the client. For instance...

  • The host should not send the client information that should not be visible to the player (eg. positions of players who are occluded behind walls). Sending this info trusts the client to keep it hidden, leading to wallhack modifications that reveal it.

    If you never send that information until it would be visible anyway, the player can't modify the client to get extra info.

  • The host should not use the results of client-side simuation (eg. movement & action success checks, player gameplay state). Using this info trusts the client to play by the same rules as everyone else, leading to modifications to move faster, clip through walls, fly, gain invunerability, etc.

    If clients send their input and the host determines the authoritative gameplay state by simulating everyone under the same set of rules, then the player with the modified client can't get away with anything that's not possible in the unmodified client. They can make funny stuff happen on their own screen, but only regular gameplay will be simulated and transmitted to the other players.

    Granted, they can still modify the client to provide better-than-human input, like perfect aim in a shooter. This requires more sophisticated cheat detection to sort out human input from mods.

If you don't have a trusted authoritative server, you can experiment with groups of peer to peer clients sharing the host role and cross-checking each other's decisions, but this gets far more complicated, and is vulnerable to attack by groups of players using the same modified client that can collude to validate each other's cheats.

Improve this answer
\$\endgroup\$
-1
\$\begingroup\$

if you sure host isent modified :

Add these to your hash code

  • size of the game imporant files(dir)
  • loaded dll(s)
  • size of loaded dll(s)
  • threads running by your app(maybe)
  • version of the game
Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Now I can't run the game because I have a different graphics driver to you. \$\endgroup\$ – user253751 Sep 4 '18 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.