1

I want to generate a string-code for the user that represents his progress in the game (so he can load this state somewhere else). I don't want him to be able to guess the system and thus load a state which he hasn't yet achieved.

The following variables are involved:

  • A number X between 1-30 representing the highest level he unlocked.
  • For each level lower than X a boolean representing whether he made the level on hard or not.
  • For each secret object he could have found (also roughly 30) another boolean.

My idea was to just build a binary number from all these but that's just way too easy for the user to hack. If he beats level 1 and then saves, he will see his code being something like 0x1, while having bet level 10 will be something like 0x200.

Pikalek
  • 12,372
  • 5
  • 43
  • 51
dasLort
  • 111
  • 4
  • Welcome to GDSE. Is the game state local to the user or on a remote, secure server? Does the game inherently rely on competition; for example, is getting a high score on a leader board the primary definition of winning? – Pikalek Sep 28 '19 at 15:31
  • The state is local but communication with my own server is possible. There is no leaderboard yet and there is no competition. Why are you asking? – dasLort Sep 28 '19 at 16:15
  • Given your situation, it seems like this question/answer addresses your problem. – Pikalek Sep 28 '19 at 17:03
  • 2
    Seems like a possible duplicate of How do I implement a retro-style password-based "savegame" system?. If it's not a duplicate, please edit your question to reflect the key differences between your question & the one linked. – Pikalek Sep 28 '19 at 17:03
  • Is the decryption of the user's passcode done on their machine or on a server you control? If the latter, any symmetric encryption algorithm would work. If the first, then what you are trying is futile, because the decryption algorithm and any secrets it requires are stored on the user's machine. – Philipp Sep 28 '19 at 17:04
  • 2
    Also, this may be a bit of an XY problem. If players feel the need to cheat in a non competitive game, I would question the underlying design of the game experience. Engaged players typically don't go out of their way (i.e. file hacking) to subvert their own positive experiences. What about the game makes cheating a preferable strategy? – Pikalek Sep 28 '19 at 17:10

1 Answers1

1

If you want to prevent casual passcode guessing, add a couple checksum bits somewhere into the passcode. Calculate the value of these bits from the values of those bits which contain actual data. When you parse a passcode, check if the values of the checksum bits matches, and if not, reject the passcode.

You can do that with a stock hash algorithm or by making up your own. Inventing your own crypto algorithms is generally a bad idea for any serious security use-case, but in this case it doesn't matter, because this solution can not be hacker-proof anyway. Any determined hacker with too much time on their hands can figure out your checksum algorithm by decompiling the game executable and finding out how it verifies the checksum. You can not get a fully hacker-proof solution using only client-side means. So you can at least turn it into a fun cryptoanalysis challenge by inventing your own (weak) hash algorithm.

Philipp
  • 119,250
  • 27
  • 256
  • 336