In a client-server game architecture, what are the possible ways to verify that the client has not modified things like gfx assets or client side scripts?

Obviously no solution is perfect, but I would love to hear some ideas.

I am thinking something like an hash on all the files in the resources directory. Does that sound feasible?

  • 1
    \$\begingroup\$ If you need automatic updates, your 'launcher' could check the integrity of client files and update any files differing : two birds with one stone, though probably not a great solution. The other problem is that any integrity checks would mean you have to recalculate the client-side hash which could take a while :/. \$\endgroup\$ Commented Oct 12, 2011 at 8:21
  • 2
    \$\begingroup\$ As Jari Komppa said, you are going to fight your customer. You should better to try to cooperate with them (especially if they pay you). Try to ride eventual creative derivatives putting the artwork to the judgment (including blame) of your user community. \$\endgroup\$
    – FxIII
    Commented Oct 12, 2011 at 12:58

2 Answers 2


If this is for hack prevention, it's a losing battle.

Things like hashes and sending random bits of data back to the server for validation come to mind, but nothing stops the hacker from using a separate, non-compromised copy of the original data as source for answering such checks.

Same goes for sending checksums of in-memory resources.

One way might be to send screenshots or checksums thereof, but then you hit the problem of different video cards/drivers rendering subtly different frames...

All that said, I'd consider outsourcing the problem to someone who has been doing it for a while, like http://www.evenbalance.com/ (punkbuster).

  • \$\begingroup\$ +1 for outsourcing. Punk buster has thousands of man years experience in this. \$\endgroup\$ Commented Oct 12, 2011 at 22:20

There's no way to reliably protect an engine that is executing on a computer you don't control, but you can make it a lot harder to cheat, for example by encrypting resources and communications traffic. Also, no one trying to hack your system will be able to do it perfectly the first time. Put in some tripwires to detect attempts to hack and permanantly ban any accounts that are caught.

  • \$\begingroup\$ Using the VAC delay system will also deter hack writers - they may release a fully working hack only to find that a day later their account is banned. It makes black-box debugging that much harder. \$\endgroup\$ Commented Oct 12, 2011 at 22:22
  • \$\begingroup\$ -1 for suggesting encryption: in these context, it will almost always give the developers a very false sense of security. \$\endgroup\$
    – o0'.
    Commented Feb 29, 2012 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .