Re: [GD-General] Re: Basic questions regarding networking games...

[Mads B. D. <ma...@ch...>]

On Tue, 24 Sep 2002, Colin Fahey wrote:

> 2002 September 24th
> Tuesday
> 
> Someone pointed out that letting a client timestamp
> events has allowed cheating in Quake.

Yep. Trusting the client (at all) did this.

> 
> Now I'm trying to figure out just how far people
> take the principle of "never trust the client".
> 

Very far, I would assume.

> I'd like to know if anyone has experienced any
> of the following scenarios, or even more bizarre
> scenarios.
> 
> [1] Someone does a "tcpdump" (or similar) and
> reverse-engineers the packets and writes a
> stand-alone application that sends packets
> that fools the game server in some way
> for the purpose of cheating.

Now, that is what _everybody_ does. The usually do a proxy though.


> ----------------------------------------------
> ASSUMPTIONS:
>   The only resource available to the hacker
>   is the binary dump of TCP and/or UDP traffic.
>   (i.e., no source code or details of packet format)
> SOLUTION:
>   Encrypt packets.

Encryption packets here have the basic problem that you deal with UDP 
traffic and you usually have a fixed format for the payload. Even if you 
pad with random strings it will still be possible, and see next point:

> 
> 
> 
> [2] Someone reverse-engineers the assembly
> language of the client and works out the
> packet format and encryption algorithm.

How about; someone traces the application, figures out the point where 
packets are decrypted (which is a lot easier than figuring out the 
algorithm) and does some fancy debugging scripts (trivial with gdb, don't 
know about others) that dumps encrypted and unencrypted packages to files 
for later analysis?

Yep, seen that done (almost, purpose not related to games). In a perl
script, btw, that used gdb breakpoint on a wellknown binary.

> 
> [3] Someone gets source code sufficient to rebuild
> the client -- with any desired logic modification.
> ----------------------------------------------
> NO SOLUTION:
>   Well, this allows the hacker to create "bot"-like
>   shooting accuracy and scripted movement patterns
>   (like running directly to all ammo spawn points,
>   or pursuing enemies with the most efficient,
>   minimal paths).
>   Even if we totally distrust the client beyond
>   receiving the most basic events possible, it
>   doesn't seem possible to detect players that
>   are "too perfect"!

I agree with the no solution stuff. The whole issue of cheating in online 
games have been debated heavily in the OSS communities, espec. following 
the release of the Quake 1 source code. You might want to look some of 
these discussion up.

> I heard of simple stuff, like turning EVERYTHING semi-
> transparent, so you can see people through the walls.

Yep, everything is a tradeof.

Mads


-- 
Mads Bondo Dydensborg.                               ma...@ch...
FAITH, n. Belief without evidence in what is told by one who speaks without
knowledge, of things without parallel.
                        - Ambrose Bierce (The Devil's Dictionary)