Arcade Games Cheatable?!

[CoryNickerson]

Well it came to my attention that something is going wrong on my forums with the arcade. A certain member is getting really high scores, and in some games it takes a long time.

This member had scored 4501 points in 29 seconds playing the game Aski. This is a game where you are a ASCII character skiing down a slope and you have to stay in the boundaries. You get points the longer you ski for.

My score was 3383 in 2 minutes 31 seconds. To have achieved his score it would have taken close to 3 and a half minutes. Which lead me to the conclusion that the timing for the arcade is wrong, or that he cheated. Since this person has some knowledge of web-design and coding, I figured he probably cheated, since he is always breaking forum rules, flaming the site, and being a rebel.

So how could one cheat? I'm not too good with flash I admit that. But I'm good with HTML.

To manipulate a flash file on a website is fairly easy. View the page with the flash file and then view page source. Then hit CTRL + A (highlights all text) and then CTRL + F (does a search) and then type in .SWF and hit the Find button. It will browse the coding of the page until it finds a URL with .SWF. This is the flash file of the game. You can then make a HTML document on your computer and input that location of the flash file into a link and save it. I actually do this from other sites to get games compatible with ibProArcade. See the link below I ripped from a site.

<a href="http://forum.snesclassics.com/arcade/3d_netblazer.swf">click here to download</a>


When you save that coding as a HTML document and open it in a browser like Internet Explorer. It will display the link that says "click here to download". Right click it and select "save target as". Now you have the SWF file on your computer. If you have a flash editor (I think Adobe bought out Macromedia so they own the rights to the new flash editors), you can open this flash file and read how the scores submit. You could easily enough edit the coding of the game, how it scores, and upload it somewhere, and then get your false score and submit.

I'd like to here from Mr. Zero and everyone else out there who knows a good deal about how these things work. My flash knowledge is still kind of limited.

Only thing I could think of to fix this false flash file submitting is something in PHP code on the page the game is displayed that submits the games score instead of on the flash file.

Any ideas?

[MrZeropage]

let me explain:

the games that can be used are converted to submit their result/score after playing to index.php or arcade.php

This is done as plain html posting the gameid, result ect. to the script.

This is the place most cheats are settled, they catch this message from game to arcade, alter the score and then transmit it.

Later I introduced some score-encryption (v32 and v33 games) which had some formula using some different values from play to play to calculate a crypted value within the (new converted) games and the arcade later decrypts them. This way most cheats described before could be defended.

But by now there is a tool available that does those calculation and makes cheating possible again, although it is not that easy for the common user as it was before.

But that is the problem of the sourcecode be open and readable - everybody could read how any encryption or protection works...


Ban cheaters from you arcade this time, by now I have no idea on how to avoid cheating without creating a new gameformat (v4 ?) which will be secure, but means all games need to be adapted again.

[CoryNickerson]

Thanks for the help zero. !! <3