Ever since I built the original Flash API tools, people have been reporting people that have hacked their scores to ridiculous levels, or hacked some kind of stat variable to unlock a medal, etc etc.
We put a lot of effort into keeping communication between your games and the API gateway fairly secure using all sorts of encryption and seeding techniques, but at the end of the day, if a game has no internal security measures, our API can't do anything about these "hackers".
To be fair, none of these cheaters are actually hackers, they are typically just dumb kids who have learned about a program called CheatEngine (or something similar). This simple cheating app allows any user to manipulate memory resident values, such as scores or in-game statistics.
Most users use cheat engine to check for values that change. If they know the exact value of the change, its even easier, but not necessary. Here's some examples:
A user starts a game with a score of zero. They tell CheatEngine to search for all memory values that equal zero. This search yeilds a large list of possible memory addresses, so they can't easily cheat yet.
The user kills an enemy and now has a score of 100 points. Now they tell CheatEngine to search within the last list of memory addresses for a value of 100. Cheat Engine narrows down all the possible addresses and comes up with a smaller list.
The user keeps repeating this search until they have narrowed the value down, then they can change it to whatever they want.
Using a similar search they can look for values that have changed (up or down) to figure out where you store things like hit points and get themselves unlimited health in any game.
So how do you combat these cheats? Well, there is no real 100% cheat proof solution, but if you understand how these cheat engines work, you can do a few things to detect when something fishy is going on.
One of the first things you should do is use getter/setter functions for sensitive variables rather than setting them directly. If you use OOP classes, you can make your score/health.etc variables private and use a getter/setter function to alias them. If you still code on timelines in AS2, you can just make a setScore(value) and getScore(value) function on _root or something to that effect.
In these functions you can apply some creativity to keep track of how much each value has changed since the last time those functions were called. Here's a small example using crude AS2 (I didn't test any of this, but you should get the idea):
// this is the variable we will store our current score in
score = 0;
// this is the variable we will use to store a value used to verify our score
verify_score = 0;
// This is a random number we will use to create our verify_score value.
// Using a random number will make it harder to figure out our scoring algorithm.
random_seed = Math.random() * 5;
// this is the function we use to set add points to our score
function updateScore(points) {
if (!cheatDetected()) {
score += points;
// this will generate a number that's almost impossible for a person to change correctly.
verify_score = Math.sqrt(Math.round(score/random_seed));
}
}
// this is used to detect whether the score was changed manually
function cheatDetected() {
// these will both be zero if no score has been added
if (score === 0 && verify_score === 0) return false;
// using the same foruma from the updateScore function we can check to see if our current score calculates
// to the same value it did when it was set using the above function.
return (verify_score != Math.sqrt(Math.round(score/random_seed)));
}
// This is used to either get the score, or return zero if the user cheated. Use this when posting high scores.
function getScore() {
if (cheatDetected()) {
return 0;
}
return score;
}
You can use a variety of methods like MD5 hashes, or something more custom to create your verification values, just make sure it's not something you can easily calculate without having access to the source code. using random seed values will make it even harder since every time they play the formula will change.
Keep in mind these formulas do use extra CPU, so you wouldn't want them running on every frame or interval on a high-load game, but for stuff like scores and health, this is a nice technique.
I strongly recommend getting a copy of CheatEngine and trying to cheat your won games.
