"js4;c-1938347" wrote:
The problem you described isn't actually a problem. Gather the first random seed from the server, or base any random seeds off of the battle time and validate against it, sending duplicate battle results from old battles will no longer be an option if it even is right now. You don't need server side processing at all, you just need a way to validate a deterministic input in the data.
Interesting. So what you are proposing actually means:
- At the start of the battle, server will send RNG seed and battle ID
- Player will play, the battle
- Player's device will send battle result and information about all involved characters (levels, abilities, gear, mods) and all player's moves to another device
- Another device will query RNG seed from the server by providing battle ID
- Device will "replay" the battle and compare the result
- Device will report to server if result is different
Are RNG implementations on all platforms same?
"js4;c-1938347" wrote:
The actual cheating that has been unearthed recently and has gone undetected has to do with client-side memory tampering. There's not a great way to detect this because anyone able to do this kind of tampering is usually able to tamper with the checks as well, unless perhaps they came up with some clever trickery.
Isn't purpose of obfuscation to make it harder to to tamper with code and purpose of whitebox cryptography to make it harder tampering with client-side memory? I'm not saying they are solution, I'm just saying that tools to make this more robust even on rooted phone should be there. They cost quite lot of money and are very complex to use right but hey, game like this is making $100M+ so money to get the right tool and right devs are there. More money you put into obfuscation and whitebox crypto, more difficult it will be to get around them and you can even mess with that with every release of the game so hackers may find it not worth it if it will be changing every few weeks.
Saying that, there are enough money for them to run their own farm of phones doing just validation. Or simply make system like you are proposing server side - I find it more maintainable ,reliable and easier to make it robust and deliver.
For know it would be enough to start with battle log people are asking for. Not only to detect cheating but also to see what can beat your teams.
Capital Games Team
