Game Development Community

File Security...

by Richard Fox · in Game Design and Creative Issues · 07/18/2003 (11:31 am) · 21 replies

Okay, I'm not really sure how to ask this because I'm not really sure what I want to know. I know I only have a question, ( I know what the Matrix is, so it isn't that)

Anyway, Let's say I have a game where players "own" "stuff", and they pit this "stuff" against other players and their "stuff" over the internet. (Think Magic the Gathering) My question is about cheating and basic fraud. How would I:
1. Keep players from using "stuff" they don't have. There will be a large amount of "stuff" that could be played in the game. However, I expect to make it all downloadable for a price. Could I use a system to test for a valid item ID or something via the internet. Something like a file-key.
2. Keep players from buffing "stuff" dishonestly. ie hacking into "stuff" to make it better than what it really is.
3. Other ways to cheat an honest guy like me can't think of. :P

I'm looking more for methods here than anything else just to see if what I have in mind is feasibl.

For instance, I think Verant maintains possesion of the actual character files on the server, right? I'm thinking something along those lines would be what I'm looking for, where all of the players "inventory of stuff" would exist on a server and only he/she would have access to it via password/login and the "inventory of stuff" would not be downloadable since it would only be a list of id's which would referrence the database of "stuff" on the server.

Forgive me for the use of the word "stuff". I know ideas are a dime a dozen, but since it's really my first idea for a game that I think I can make money on I think I'll remain vague. I have other ideas, some I've even posted. However, this one is my favorite, so I'll keep it to myself. For now.
Page «Previous 1 2
#1
07/18/2003 (11:55 am)
The only way you can be 100% sure is to store all the variables and data on a server, then let the client connect to get the data. Even this system could probably be hacked apart... but it'd be a lot harder then hacking a client side file format or something like that.
#2
07/18/2003 (12:03 pm)
Hi Richard,

This is something I though about a while ago, although I didn't take the idea right to the end. Something like this can be achieved using simple old HTTP access from within your game. You may think HTTP is unsecure (it always uses port 80 for example, and can be monitored easily). However, if have the ability to use a secure HTTPS connection from you're game, I'm sure it's possible in a secure fashion. There are several things you can do when writing a dynamic web page, one of the most useful of those is checking for a particular custom header being present in the page request - if it isn't, you redirect to your homepage. This stops people accessing the update pages with any method other than your game, and works quite well. And data passed to the page is 'hidden' in the page request as a posted FORM, rather than being in the URL i.e. : //myserver.com/Show.asp?file=5999 - the 'file' parameter is easily visible, and cheatable if the hacker knows the exact parameter name.

The full explanation requires some web development knowledge - preferably ASP, although I'm sure PHP is an option too. Would you like to hear it? Not sure if you were thinking of using a web site, or an actual 'server program' written especially to do the job.

-Darren.
#3
07/18/2003 (12:11 pm)
In the case of storing the data on the server for the client to connect to and retrieve with a key, the casual hacker would be more likely not to bother and I would asume the more apt hacker could be detected on the server and booted. Am I correct?
I've though of other ways too, without caring if they copied files and shared them to their hearts content. Just make "stuff" random for the downloads and the odds of getting the super dope "stuff" is less likely than the normal general strength "stuff". Just guarantee so many "stuff's", like 25 "stuff's" per download for $x.xx, and you get what you get. Of course, the hole in this approach is once the rare "stuff" got out on a download, then it would no longer be odd or rare. However, it wouldn't be benificial to the players to flaunt their catch to everyone in the form of copies, because then EVERYONE will be running around with the "Vorpal Stuff Thingamajig", and then I would have to make a whole new set of "stuff". Of course, I would be doing that anyway. The "stuff" thing is getting stupid, I know, but please bare with me.
#4
07/18/2003 (12:17 pm)
Hmmm,

I think you'll have to give us more details mate :-) How is the 'stuff' counted and used? Could you have, maybe 50 of it, and choose to use 10, leaving you with 40? If so, and you're avoiding storing locally on the client, the Inventory for each player will need to be updated with the server each time the inventory changes - if this is happening mid-game and not just when people join a game, you're going to need some serious grunt on the server end to continuously update each players inventory and send the details back to them.

-Darren.
#5
07/18/2003 (12:30 pm)
Darren:
I don't know either PHP or ASP and in fact I haven't done much on the web site development area at all. My programming skill is pretty much limited to C++ and 2D graphics techniques. However, any direction to new knowlege is always appreciated.

I'm just now learning how to do the TCP/IP connection for multiplayer games, so that's pretty much where I've started on in that area.

The graphics of this game will be dated, 2D ISO, but I think I can make it attractive based on gameplay and hopefully I can find some nice art. I'm still waiting for www.digitalboneyard.com to come up. A 3D version can come out later, IF I ever get it into development. It has all the elements of a "crack game" I just need to develope the gameplay and design.

To be honest I would love to start the project soon, but I'm in school right now and working full time for the US Navy. Plus I'm not really certain how I would start it anyway, since I've never started a project with anyone, everything I've done has been on my own (and that hasen't been alot either)

I'm sure this can be done so easily with the right management and damn near any decent tile engine with proper internet securities in place that it could be incredibly successful.
#6
07/18/2003 (12:44 pm)
OK,

Well, using TCP/IP would give you even more control over the security of the data, that's for sure. I suppose the main problem with this approach comes when your 'master server' (the one controlling the inventories) is down or unavailable. In most cases, if the game would run without the master server (i.e. the last copy of the inventory is stored locally for each client) then players will be able to play as normal. However, if the game relies heavily on the master server before it can actually start a game, when the master server goes down it effectively 'swtiches off' your game, for all players. One to avoid, especially if you're using cheap / simple hosting.

Maybe you could post _some_ of the idea (as much as you think neccessary to get people interested) in the Help Wanted area of this site - I'm sure you'd be able to attract people to a team. I'm afraid for advice on building that team you would be better asking somebody else. I do think, however, that if you could control a team and supply them all with their individual work (acting as team leader) you'd be able to get your idea created with a minimum of hassle.

-Darren.
#7
07/18/2003 (12:48 pm)
How the "stuff" is used:
Slight details...
The "stuff" is arbitrary, really. All that needs to be known about the "stuff" is that the player has access to it before the game starts and picks what "stuff" he is going to use for the next game. The "chosen stuff" will be used during the game, but only a portion will be available to him at any given time, like playing a card game.'hint' Once a particular item of "stuff" has been used...

Oh, hell this is ridiculous. I would do terrible in an interrogation.
Here's the game:
It's a turn based game in which(at the moment) two players build an army of creatures/spells from a set of "owned stuff" and then pit them against eachother via the internet. There will be a limited total number of creatures, spells and other things that the player can use. If a player wants to make nothing but creatures then he can do that. If he wants to make a set of nothing but spells he can do that too. All the "stuff" is permanent in that it never changes. The creature is always a creature and always has the same ability as somebody else's creature of the same type unless a spell or other stuff is used on it to make it otherwise during the game. There are other factors involved that make the game unique, but this is the very basic point of the "stuff".

EDIT: No, this is not a card game, that has already been done.

I'll have to pick back up on this thread when I get home later. I have to get a staple removed from my step-sons head, ouch. I told him not to run in the house. :P
#8
07/18/2003 (12:53 pm)
Instead of storing *all* the data on a server you could just store MD5's or something.
#9
07/18/2003 (1:21 pm)
If you want perfect security, all you can do is store _all_ the data on the trusted servers and run _all_ the game logic there. The clients do nothing but display results that they get from the server.

Every other topology is crackable on the client side.
#10
07/18/2003 (1:48 pm)
Mark-
I like that approach. All the client needs to know is "what" happened.

I guess I could put an ad in the Help Wanted area and see if anyone would be interested in making something like this. Like I said, it has all the potential of a "crack game" and any developer could make some money off this. I still have to iron out details and produce more design documents. The cool thing is I'm not just some guy with an idea for a game. I do have experience in programming, art, scripting, and level design. Although I have very little in monetary resources I CAN lead and design. So, I guess that would make me Lead Designer/Project Leader,... on a project I don't really have yet.

More to come...
#11
07/18/2003 (2:14 pm)
Richard,

What Mark suggested is pretty much what we're doing for our new game "Strategem". All the logic and decisions are made on the server with the client having just enough information to get by. It should be pretty secure but it does require an extraordinary amount of planning to ensure that you've got enough information on the client to not only do it but to do it efficiently.

We have a realm-board which contains secure information such as pieces that are 'stealthed'. These pieces cannot be seen by all the clients but can be seen by the owner of the piece. This kind of stuff requires some nifty amendments to the way data is distributed to clients.

Sometime though, you'll find that you've got to send certain information to the clients and allow them to make a decision but you should *always* authorise by checking the transaction as soon as the request comes from the server and handle illegal requests gracefully.

Your game sounds similar to the one we've been developing for the last six months. We should be getting some cool screenshots out there soon.

- Melv.
#12
07/18/2003 (6:40 pm)
Thanks Melv, I look forward to seeing some of the screenshots to see how similar our games are. Tell me though, are you doing it in 3D or 2D? I have ideas of how to do it both ways,(by design I mean) But I think I will stick with the 2D approach. It'll make a good demo/promo anyway. I still have much to learn about the server/client stuff. Plus I still need to really hash out the game on paper before I attempt to put together a team.
#13
07/19/2003 (2:23 am)
Richard,

Ours utilises 3D to as full an extent as possible e.g. interesting pre-defined camera angles for certain events and such like. Sticking to 2D would make it much easier for you as one of the first hurdles was that our board contains 256 squares (16x16), each of which could be occupied by a 3D model. This called for two things; the first being a good LOD on the models themselves and the second, a specialised shape 'blitter' manager that renders all the shapes in a single pass and bypassing the networking altogether; something that doesn't come stock with the TGE (it will do after we release our game). We get really good frame-rates on geForce2 with 256 animated models plus particle effects at all LOD.

These problems will go away if you do 2D so I'll leave the choice to you. :)

Ooh, we've been holding back on the screenshots but they are so close now.......

- Melv.
#14
07/19/2003 (3:22 am)
Melv,

That's pretty impressive going :-) It sounds like you've got a damn good grasp of the TGE, and I can't even imagine the amount of fans you'll have when you release both your game, and your code additions. Well done mate! :-D

@Richard - if you need to get a prototype of this working, why not try either DarkBasic or Blitz3D - both have exceptional 2D and 3D code, not so robust with the networking but they do support TCP/IP and UDP. That way, you could prototype your idea and show it to potential team members. You may then attract a developer who could take te game further.

-Darren.
#15
07/19/2003 (4:41 am)
Interesting thought Darren. Whats the sticker price on those? I've never messed with either, but I'm certain I can pick it up very quickly. Although, I still think I could put together a demo rather quickly(time permitting) in C++. I just need art, and sound would be nice too. And I'm still not sure about a good algorithym for tile transitions in ISO. I'm working on it though. Again though, I'm sure an existing ISO tile engine would do fine.
Know of any good art resources out there for 2D ISO games? The up and coming www.digitalboneyard.com
[url =www.garagegames.com/mg/forums/result.thread.php?qt=10572]Click here for thread [/url]will host a bucket full of dead stuff from old projects, but I'm still waiting for the site to come up.


EDIT: Is my link to the thread woriking? It doesn't look like it should appear. I followed the instructions below. Is there another way to make a link to a thread?
#16
07/19/2003 (5:10 am)
Check these sites Richard:

www.darkbasic.com

EDIT: Apologies, blitz3d doesn't seem to work...try this...

www.blitzbasic.com

If I remember correctly, they both weigh in around $100 USD, although DarkBasic seems to have lots of options you can buy with the main product. This may be a little more than you wanted to shell out, but the websites will show you how good the products are.

You can download a trial of both, and the size of code is pretty awesome given the effect you can achieve. Also, I noticed a book a while ago that may be useful - it's called 'Isometric Game Programming With DirectX 7' - the DirectX is obviously dated, but I think the book goes quite deeply into writing a fast ISO engine. Could be worth a look. But, as you say, if you can find an existing engine to use, that would be great. Only concern there is integrating it to your game idea, or the other way around. I suppose if you can find a C++-based engine, you'd be good to go.

I used the standard link in this post, i.e. I didn't add the 'click here' bit, but just placed the address inside the URL markers. I'll see if that works in a moment :-)

When it comes to art, you may be able to cheat. If you can make 3D objects and texture them (some kind of building, sat on top of a totally square block), you could then roate them to the desired ISO angle, take a 'snapshot' or screenshot, and use that as your 2D Art.

With textures etc., I would recommend downloading the 'Golgotha' source and files, if you haven't done so already. The project died some time ago, and one of the people involved has made the entire source code, graphics and audio resources available for download. Even if it doesn't provide everything you need, I'm sure it's worth downloading just for the professional content. It can be found at:

jonathanclark.com/golgotha/

Hope that helps mate! Keep posting if you need more info etc.. I'm not the most knowledgable person here by far, but I'd be happy to help where I can.

-Darren.
#17
07/19/2003 (7:39 am)
I like the BlitzBasic, it looks interesting. I do have the ISO book you mentioned. In fact I took Mr Pazera's DX7 tilset class and changed it so it would work with windows GDI, just to keep things simple. I learned quite a bit about DX but I have yet to implement any of it yet. I figured my games would reuire, yet, a really high frame rate for fast blitting so I stuck with the GDI for now. I've learned, on my own, so much about C++ in last 2 and half years since I got back into making games that I'm afraid though that if I start learning something like DB or Blitz that I would be taking a step backwards. Would that be the case, do you think, or would I really be taking a stpe forward in creating demos? I looked at some of the code and it just gave me flashbacks to GWBASIC with some of the syntax, so that's probably where that backstepping feeling came from.
I downloaded the Golgatha sound files, but the graphics seemed a little to sci fi for what I want to make. However, I will deffinitely add the site to my favorites list.
Thanks for th advice.
Oh, and BlitzPlus is only $60 USD.
#18
07/19/2003 (11:09 am)
With the backstepping thing, I think it's totally down to your own perception. Sure, both products are based on Basic, and at the end of the day, I haven't heard many people boasting about their Basic programming abilities :-) But, it depends where you want to be at the moment - if you are confident that when you have some art to use, you can build the ISO engine to use DirectX, then that may be the best option. However, if you have the art available and would like to knock something up quickly, maybe a prototype, maybe even a demo, one of the Basic products may be best.

Some of the decision will be based on your time frame - how quickly do you want to get it working, and do you plan to create the final, publishable game yourself? If you have the time to play with it, I think you would choose the C++ route - I would, because the feeling of getting it done and working would be much better than if you'd done it with Basic. Sure, the end result is what matters, but I think us programmers feel more satisfied when we have been challenged properly - writing C++ stuff is sometimes easy, and other times the simplest mistake can have you debugging and tweaking for some time. People that have the time to do this will say 'it's all part of the fun' - those who don't have the time will say it's the reason they write in something like Basic :-)

Plus, if you go quite far with the code in Blitz, and then make the decision to switch, you will have to 'port' your code extensively (the theories and techniques employed will doubtless be the same, but the code will be very different). This is probably why it's best for prototyping ideas...

I'm not too sure if that helps at all!

Oh, going back to something you mentioned earlier - I think 2D ISO games can look very impressive with the right art, and some types of games just seem to work best when they use a simple display method like that. When developing for a PC, and using simple 2D techniques, you know that you can afford to be a bit extravagant with things like screen resolution and texture or 'tile' detail, so the more artistic detail you can cram in the better.

-Darren.
#19
07/19/2003 (11:50 am)
Darren,
Thanks for all the input. Looking at the different reasons someone would use BASIC as opposed to C++ to make a game, I think I'll stick with C++. Not that I have the time, but considering the 'porting' issues, I don't have the time for that. If I make a demo, or prototype in C++, with maybe just Windows GDI and Maybe DirestSound and DirectInput, advancing the program into a distributable game from that point should be less painful, I would imagine.
I should, however, dedicate more time getting the DirectDraw thing down. Not that it is giving me problems, but Windows GDI is just simpler. Right now I'm still using Windows GDI. For turn based games or demos I don't think that's so bad, for now. But, I will have to use DX or something else similar sooner or later.
I haven't picked up my ISO book in a while, I think it's time to do so. However, I want to avoid creating an entire engine for this game. But I will need to make some editing tools for the maps and creatures, etc...

Forgive me if my posts seem to jump around as you read them. I'm trying to deal with two kids and post at the same time. So, I may end up just putting down what comes to mind when my head gets back to the screen :P
#20
07/19/2003 (12:18 pm)
No problem mate, I'm really enjoying these discussions on GG at the moment. My own game development is stalled for a few weeks, due to writing business applications to earn some cash!

Yep, I think DDraw is the way to go eventually, if you go for C++. I haven't done DX for ages, I think in the newer versions they killed DDraw a little. But, they tried to move everyone onto using D3D or 'DirectGraphics' for 8, and now I think they've re-implemented some of the DDraw stuff as it was before. True control over surfaces, their location in memory, and page-flipping etc.

How complicated would the map editor need to be? Would it be better written in something like VB.NET, rather than using C++/MFC? Not sure how you are with the Windows stuff in C? I've dabbled with MFC from time to time, but found it quite annoying in places. VB.NET offers the new 'Managed DirectX', meaning you don't use any COM code to access the objects, and it's frighteningly easy to blit stuff into a VB window. I've dabbled with VB.NET, and it's worlds apart from VC6, they've done a good job bringing it's power closer to the rest of the Visual Studio stuff.

Sorry, I'm wandering off onto totally different subjects now, taking your time up :-)

I'm going to cook up some food...

-Darren.
Page «Previous 1 2