How to make sure user is running the newest version of mmo client?

Question

In typical mmorpg game, you have a launcher and a client. You first run the launcher to update the client, then you run the client. In every mmo I tried if you run a client without updating first (if update is available), it automatically closes and (usually) starts launcher.

My question is, how can you check if user has the proper version of client? I though about server asking client about its md5 however it's so easy to cheat. I think that there is no safe way of handling it yet every mmorpg I know uses such a system.

So how do mmorpg games handle this problem? To make sure that the client is at the newest version?

Answer 1

I once found a very neat quote on the net that's very, very true for any online game:

The client is in the hands of the enemy.

As such, you can't really avoid people doing nasty things to your game client. Due to this, don't trust the client at all, i.e. everything important should at least be verified server side (better: calculated there). If this is done properly, the player won't be able to do anything harmful with their manipulated client.

As for your login thing, I'd say it's perfectly fine to keep some magic number in your client determining its version (usually a protocol version or some checksum). This is passed during the login process. If it doesn't match, access is denied.

In addition to that, ensure the game client is started by the launcher. There are several ways to do this, e.g. the actual game client could be a dynamic link library - not a real executable file - which is then loaded and run by the launcher.

Overall, there's no 100% perfect way to avoid manipulations and the like. There's always some way to cheat or modify something (even if it just happens in-memory). Live with it and just fight those really doing something wrong rather than trying to secure everything.

Such checks should only keep the player from accidently connecting with or using some kind of manipulated or broken client. If the player forcefully circumvents such measures, it's their problem in case something goes wrong and their client acts weird, displays wrong things, etc. (i.e. other players must not be affected, but if the player manipulating their game can't play, it's their problem).

Answer 2

I though about server asking client about its md5 however it's so easy to cheat.

MMOs include a version checking system to help make sure that legitimate (non-cheating) users are using a compatible version, and to help them upgrade to a compatible version if they are not, in short its to make updating easier for the player rather than for any form of cheat protection. (Even if a client sends a correct version version identification notice there is nothing preventing future messages between the server and client being compromised).

Probably the simplest way is simply for the client to send a version number and the server to send either a "Yes this is a compatible version" message, or a "No, you need to upgrade from this URL".

Answer 3

I remember that in Tibia they use an updater after client is started and you enter your correct password. If the client version is different, size~ etc. The client enters the patching mode, and it updates itself.

If you won't have the correct client version the auto-updater will not let you inside the game + if it detects any type of bot that got plugged into the working game you will get an auto-ban.

You can do the same as they have done it, check the bytesize of all scripts, and if the file size is different call it to send it over to you. That way you will have the cheater/hacker on a fork - with his account. :)