# Implementing a score cheating prevention system in an offline game with an online score board: How to protect game fairness?

This is hopefully a very simple question. It isn't about loading assets (which is all I found while searching)

Basically I have a template, say Object_Monster that has stats, abilities, etc. But I don't want to abstract it and create Object_Monster_Witch, Object_Monster_Ghoul and so on.

I want to know the best way to store data for loading many "different" monsters for one monster class. But I don't want the data to be editable by players.

For example. Lets say a Ghoul has 50 max health, the name "Ghoul" and the Consume ability. I would want all those variables listed somewhere to then be loaded into Object_Monster so he can act as a Ghoul.

I hear people use XML for this sort of thing, but that is of course, edited on the fly. Should I be using just an in-code list of #defines? An array of monster data?

• You could still use XML but encode the data when it's on the hard-drive and decode it on-the-fly when it's loaded into the game. – Casey Apr 25 '14 at 23:37
• One way of ensuring the players' data is "your" data that hasn't been covered yet is to include with each data file a 'checksum' of the file's contents that's been hashed with a private key. This of course doesn't prevent sufficiently determined clients from either cracking open your code to see what the key is (many large-scale game studios have code to obfuscate the hashing and the key, but it's far from 100% effective) or simply skipping the checksum check, but it's a common and reasonable first step. – Steven Stadnicki Apr 27 '14 at 16:33

When the players want to edit stuff, they will find out how. Hardcoding attributes won't stop a determined modder for long.

So I would recommend you to do the only sensible thing and put that data in a config file. XML is just one option. Some people prefer JSON or custom formats because they are simpler to write and read. When you don't want to make the files too obvious, you could bundle resources as zip-files, but not name them as such. That way a modder needs to put in at least a bit of effort to find out which file format they are dealing with.

Hardcoding this data as constants in the code would be terribly unpractical, requiring a recompile of the project for every change. Even for small games this is very annoying.

To make the game data opaque, you either have to write custom binary formats or pack every text file into a compressed (ZIP) folder. You might even go to the extreme of encrypting the data, but I've never heard of such case for things like game assets.

Like it was commented before, players of your game with a bit more technical skill will eventually find a way to crack custom file formats and edit the game. But think again about this, do you really want to make your game like so? A frozen piece of software that will eventually get old and go out of production and no one will ever be able to improve it or fix it? I have a very open mentality on this matter, and as a developer, I always prefer to make the technical details of my games as open as possible, either by giving away documentation about custom file formats or editing tools that the player can utilize to mod the game. I find that this not only greatly increases the lifetime of a game but also lead to the creation of modding communities that will ultimately do a lot of free publicity for your stuff.

• Hello, thanks for the answers (all of you). But one thing I would like is a ranking score for my game. If they could set the, for example, max hp of all the monsters to 1, then it wouldn't be fair to have the table online. I would ideally want to make sure their scores are legitimate. Is the only way to do this to have them play through a server? – Nexian Apr 26 '14 at 11:57

According to your comments the question is: how to implement some form of score board cheat prevention in an offline game with an online score board. Obviously, if the game is played offline, the least of your concerns is that players modify the game elements to throw off the balance, use that to win and post an unwarranted high-score. Your main concern would be that they simply send a couple of packets that say "Hey Mr. Server I got a really great score" and the server will reply "OK, I'm just going to stupidly accept this ... because you claim this to be true, it must be so" and done. They have any score they want with their name on it. What the server should say is "Pics or it didn't happen!".

In order to have some minimal control over the correctness of the scores I would suggest you make the game's behavior deterministic (in this sense):

• Any randomness needs to be controlled by a seed (so it's reproducible).
• Any floating point computation needs to be removed or replaced by a deterministic alternative.

Now record the players input during the game and once the game is over send the recording if the score is high enough to warrant being checked. Play the recording on the server in a checker and see if the official game constraints are broken. This does not prevent them from creating something like a "TAS" (tool assisted speedrun) with some hacks on the machine. For additional measures you may want to have form of control over the seed of the game like seed A is reasonable if the game was started at time T.

If you want to prevents players from cheating offline: that's impossible. If it were possible then people would have found ways to prevent users from cracking games in the first place.

If you want to add some measures to make it more difficult to cheat offline and then publish that as an achievement online then there might be some more things you can do but this really deserves it's own question.

BTW, encrypting the data and then decryption it during run-time is just a form of obfuscation and isn't considered a real measure of protection.

• Well, knowing it isn't possible in any real sense is good to know. The scoreboard was more of a rough example of what I would want to do. My real reason is that I would want people to be able to play with others online, but without having to personally host servers myself, letting the players host their own servers. I would ideally want to keep cheating to a minimum among groups of random players, but the only way I would see to do this is by hosting a lobby and checking each server through that. – Nexian Apr 27 '14 at 14:27
• You can't fully protect the correctness of your software's authenticity against corruption unless the other users are willing participants and wish to send you the needed information. If they are willing participants then they wouldn't want to corrupt your game's contents in the first place. If there is a will, there is a way as far as cheating goes. – AturSams Apr 27 '14 at 15:20