非网页游戏的安全在线高分列表
我正在玩我正在编写的本机（非网络）单人游戏，我突然想到有一个每日/每周/所有时间在线高分列表（想想 Xbox实时排行榜）将使游戏变得更加有趣，增加一些（少量）社区和竞争。 然而，我担心人们会把这样的功能视为黑客邀请，这会因为高得离谱的分数而让普通玩家望而却步。
我考虑了防止此类尝试的明显方法（例如，公钥/私钥加密），但我已经想出了相当简单的方法，黑客可以绕过我的所有想法（从二进制文件中提取公钥，从而发送伪造的加密数据）例如分数）。
您曾经实施过在线高分列表或排行榜吗？ 您是否找到了一种合理的防黑客方法来实现这一点？ 如果是这样，你是怎么做到的？ 您在黑客攻击方面有哪些经历？
I'm playing around with a native (non-web) single-player game I'm writing, and it occured to me that having a daily/weekly/all-time online highscore list (think Xbox Live Leaderboard) would make the game much more interesting, adding some (small) amount of community and competition. However, I'm afraid people would see such a feature as an invitation to hacking, which would discourage regular players due to impossibly high scores.
I thought about the obvious ways of preventing such attempts (public/private key encryption, for example), but I've figured out reasonably simple ways hackers could circumvent all of my ideas (extracting the public key from the binary and thus sending fake encrypted scores, for example).
Have you ever implemented an online highscore list or leaderboard? Did you find a reasonably hacker-proof way of implementing this? If so, how did you do it? What are your experiences with hacking attempts?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
@马丁。
我相信《马里奥赛车 Wii》就是这样运作的。 额外的好处是，你可以让所有其他玩家观看高分持有者如何获得高分。 有趣的是，如果您查看最快的“Grumble Volcano”时间跟踪，你会看到有人找到了一条捷径，可以让你跳过 95% 的轨道。 我不确定他们是否仍将其视为最快时间。
@Martin.
This is how I believe Mario Kart Wii works. The added bonus is that you can let all the other players watch how the high score holder got the high score. The funny thing about this is that if you check out the fastest "Grumble Volcano" time trail, you'll see that somebody found a shortcut that let you skip 95% of the track. I'm not sure if they still have that up as the fastest time.
正如另一个答案所说，您被迫信任潜在的恶意客户端，并且简单的威慑加上一点人工监控对于小型游戏来说就足够了。
如果你想变得更有趣，那么你必须在分数数据中寻找欺诈模式，类似于信用卡公司查看收费数据。 客户端与服务器通信的状态越多，就越容易通过代码找到正确或不正确行为的模式。 例如。 假设客户端必须上传基于时间的分数审核日志（也许您也可以使用它来让其他客户端观看热门比赛），然后服务器可以验证分数日志是否违反任何游戏规则。
最后，这仍然是为了让比赛变得足够昂贵，以阻止在记分牌上作弊。 您需要一个可以始终改进（更容易更新）服务器代码的系统，以应对验证系统上的任何新攻击。
As the other answer says, you are forced to trust a potentially malicious client, and a simple deterant plus a little human monitoring is going to be enough for a small game.
If you want to get fancy, you then have to look for fraud patterns in the score data, simmular to a credit card company looking at charge data. The more state the client communicates onto your server, the potentially easier it is to find a pattern of correct or incorrect behavior via code. For example. say that the client had to upload a time based audit log of the score (which maybe you can also use to let another clients watch the top games), the server can then validate if the score log breaks any of the game rules.
In the end, this is still about making it expensive enough to discourage cheating the scoreboard. You would want a system where you can always improve the (easier to update)server code to deal with any new attacks on your validation system.
当游戏在用户控制的系统上运行时，任何解决方案都不会是完美的，但是您可以采取一些步骤来使黑客入侵系统变得更加麻烦。 最终的目标只能是让黑客入侵系统变得比其价值更麻烦。
总而言之，让这款游戏足够流行，让人们愿意破解它可能是一个更大的挑战。
No solution is ever going to be perfect while the game is running on a system under the user's control, but there are a few steps you could take to make hacking the system more trouble. In the end, the goal can only be to make hacking the system more trouble than it's worth.
All in all though, getting the game popular enough for people to care to hack it is probably a far bigger challenge.
这是一个非常难的问题。
我从未实现过这样的事情，但这是一个简单的近似值。
您主要担心的是黑客猜测您的应用程序正在做什么，然后发送他们自己的结果。
嗯，首先，除非你的申请非常成功，否则我不会担心。 做这样的事情是极其困难的。
加密无助于解决这个问题。 您会看到，加密有助于保护传输途中的数据，但在数据加密之前它不能保护交易的任何一方（这可能是主要漏洞所在）。 因此，如果您对数据进行加密，数据将保持私密性，但并不安全。
如果你真的担心它，我会建议混淆代码并以一种不完全明显的方式设计评分系统。 这里我们可以借用加密协议的一些东西。 这是一个例子：
如您所见，这只是另一种混淆。 只要你愿意，你就可以沿着这条路走下去。 例如，您可以查找最接近 X 的两个素数，并使用它们来加密 CRC 并将其也发送到服务器，这样您就可以分别使用不同的加密方案获得 CRC 和分数。
如果你将其与混淆结合使用，我会说这将很难破解。 尽管如此，即使这可以被逆向工程，这一切都取决于黑客的兴趣和能力，但是......说真的，什么样的怪物需要花费如此多的努力来改变游戏的结果？ （除非是《魔兽世界》之类的）
最后一点
.NET 的混淆器
用于 Delphi/C++ 的混淆器
汇编器混淆器 (x86)
That's a really hard question.
I've never implemented such thing but here's a simple aproximmation.
Your main concern is due to hackers guessing what is it your application is doing and then sending their own results.
Well, first of all, unless your application has a great success I wouldn't be worried. Doing such thing is extremely difficult.
Encryption won't help with the problem. You see, encryption helps to protect the data on its way but it doesn't protect either of the sides of the transaction before the data is encrypted (which is where the main vulnerability may be). So if you encrypt the sure, the data will remain private but it won't be safe.
If you are really worried about it I will suggest obfuscating the code and designing the score system in a way which is not completely obvious what is doing. Here we can borrow some things from an encryption protocol. Here is an example:
As you see that's just obfuscation of another kind. You can go down that way as long as you want. For example you can lookup the nearest two prime numbers to X and use them to encrypt the CRC and send it also to the server so you'll have the CRC and the score separately and with different encryption schemes.
If you use that in conjunction with obfuscation I'd say that would be difficult to hack. Nontheless even that could be reverse engingeered, it all depends on the interest and ability of the hacker but ... seriously, what kind of freak takes so much effort to change its results on a game? (Unless is WoW or something)
One last note
Obfuscator for .NET
Obfuscator for Delphi/C++
Obfuscator for assembler (x86)
我已经在我的 Flash 游戏中做了一些这样的事情，但这确实是一场失败的战斗。 特别是对于 ActionScript，无需太多努力就可以反编译成可读的代码。
我这样做的方式是一种相当传统的方法，以纯文本形式发送分数和玩家姓名，然后发送两者的哈希值（适当加盐）。 很少有人有足够的决心去努力解决这个问题，而少数人无论如何都会这么做，否定你投入的所有时间。
总而言之，我的理念是花时间让游戏变得更好，并且让作弊变得足够困难。
可能非常有效的一件事是让游戏在您玩游戏时多次向服务器提交分数，每次发送一些游戏信息，以便您验证分数是否“真实”。 但这确实可能有点过头了。
I've been doing some of this with my Flash games, and it's a losing battle really. Especially for ActionScript that can be decompiled into somewhat readable code without too much effort.
The way I've been doing it is a rather conventional approach of sending the score and player name in plain text and then a hash of the two (properly salted). Very few people are determined enough to take the effort to figure that out, and the few who are would do it anyway, negating all the time you put into it.
To summarize, my philosophy is to spend the time on making the game better and just make it hard enough to cheat.
One thing that might be pretty effective is to have the game submit the score to the server several times as you are playing, sending a bit of gameplay information each time, allowing you to validate if the score is "realistic". But that might be a bit over-the-top really.
如果您的游戏内置了重播系统，您可以将重播提交到服务器并让服务器根据重播计算分数。
这种方法并不完美，您仍然可以通过减慢游戏速度（如果是基于动作的）或编写机器人来作弊。
If your game has a replay system built in, you can submit replays to the server and have the server calculate the score from the replay.
This method isn't perfect, you can still cheat by slowing down the game (if it is action-based), or by writing a bot.
老实说，我认为这是不可能的。
我之前已经使用过非常简单的密钥加密和压缩的二进制文件来完成此操作，该加密方式足以满足我所需的安全性，但老实说，我认为如果有人考虑破解您的在线高分表，那么它就会完成。
那里有一些非常悲伤的人，但他们也恰好很聪明，除非你能让他们都安定下来，否则这是一个失败的事业。
I honestly don't think it's possible.
I've done it before using pretty simple key encryption with a compressed binary which worked well enough for the security I required but I honestly think if somebody considers cracking your online high score table a hack it will be done.
There are some pretty sad people out there who also happen to be pretty bright unless you can get them all laid it's a lost cause.
通常，防止作弊和黑客攻击的最大防御者是社区观察。 如果分数看起来相当可疑，用户可以报告作弊分数。 如果有足够多的人报告该分数，管理员可以检查重播的有效性。 如果已经有一群完全合法的玩家在玩游戏，那么很容易看出机器人和实际玩家之间的区别。
管理员必须只监督那些受到质疑的分数，因为一小群用户可能会跟风删除来之不易的分数。 管理员只需查看报告的少数分数，因此他们的时间不会太多，对于小型游戏来说更是如此。
即使只是知道，如果你努力制作一个机器人，只是再次被举报系统击落，这本身就是一种威慑。
也许甚至对重放数据进行加密也不会造成什么影响。 重放数据通常很小，对其进行加密不会占用太多空间。 为了帮助改进这一点，服务器本身将尝试通过控制日志进行重播，并确保其与所获得的分数相匹配。
如果反作弊系统找不到某些东西，用户会找到它。
Usually, the biggest defender against cheating and hacking is a community watch. If a score seems rather suspicious, a user can report the score for cheating. And if enough people report that score, the replay can be checked by the admins for validity. It is fairly easy to see the difference between a bot an an actual player, if there's already a bunch of players playing the game in full legitimacy.
The admins must oversee only those scores that get questioned, because there is a small chance that a bunch of users might bandwagon to remove a perfectly hard-earned score. And the admins only have to view the few scores that do get reported, so it's not too much of their time, even less for a small game.
Even just knowing that if you work hard to make a bot, just to be shot down again by the report system, is a deterrent in itself.
Perhaps even encrypting the replay data wouldn't hurt, either. Replay data is often small, and encrypting it wouldn't take too much more space. And to help improve that, the server itself would try out the replay by the control log, and make sure it matches up with the score achieved.
If there's something the anti-cheat system can't find, users will find it.
您无法在不受信任的客户端平台上执行此操作。 在实践中，甚至有可能击败一些“可信”平台。
有各种攻击在一般情况下是不可能检测到的——主要是修改内存中的变量。 如果你不能相信你自己的程序的变量，你就不能真正取得很大的成就。
上面概述的其他技术可能会有所帮助，但不能解决在不受信任的平台上运行的基本问题。
出于兴趣，你确定人们会尝试破解高分表吗？ 我玩一款在线游戏已有两年多了，高分表简直就是破烂不堪。 很多人都玩过，但我没有证据表明有人试图破解高分。
You can't do it on a nontrusted client platform. In practice it is possible to defeat even some "trusted" platforms.
There are various attacks which are impossible to detect in the general case - mainly modifying variables in memory. If you can't trust your own program's variables, you can't really achieve very much.
The other techniques outlined above may help, but don't solve the basic problem of running on a nontrusted platform.
Out of interest, are you sure that people will try to hack a high score table? I have had a game online for over two years now with a trivially-crackabe high score table. Many people have played it but I have no evidence that anyone's tried to crack the high scores.
归根结底，您依赖于对客户的信任。 如果客户端将重播发送到服务器，则很容易复制或修改成功的播放并将其发送到服务器。
最好的选择是将作弊的标准提高到玩家认为值得超越的标准之上。 为此，您可以使用许多经过验证的（但经常未被提及）的技术：
At the end of the day, you are relying on trusting the client. If the client sends replays to the server, it is easy enough to replicable or modify a successful playthrough and send that to the server.
Your best bet is to raise the bar for cheating above what a player would deem worth surmounting. To do this, there are a number of proven (but oft-unmentioned) techniques you can use: