Preventing Cheating

[Patterrun]

Hi, TNet forum and Aren.

I was wondering, how do I prevent cheating with TNet? I won't pretend I know a lot about networking or setups. I have used Unity's default networking and Photon to create some tests but TNet seems much better. For example when I use interpolation techniques to smooth out clients movements and animations in player's views, no matter what I did, TNet's examples still were way smoother even with my best techniques. So it seems I have a lot to learn and I will settle with what I know for now. And so I was reading the forum for threads about server setups and mainly, to prevent cheating, but I don't quite understand.

At first I saw that you do not recommend setting up an authoritative server setup as opposed to default authoritative host setup that TNet is. But then I also read that other people are trying to do the former or something similar but even after several threads I haven't pieced enough information to understand. I realize that to do an authoritative server setup, I would need something like the Photon Server where I write server side code and lobby and put that on the server, then clients connect to the Photon server and request to start rooms. Logic is then handled by clients sending requests to the server and performing prediction on clients to make them seem smooth with the responses coming from the server correcting mistakes/also preventing cheating. To do that with TNet I would have to create a game instance with each request to create a room/channel so the game instance in the server would be authoritative instead of any of the clients as the first creator is the authoritative host, but this is not feasible even with a few dozen concurrent players in a day. I'm not sure if that is even possible.

And as far as I know, with a client authoritative setup, the host client may be a cheater. If so he can just do whatever he wants, manipulate players, inflate scores to be sent, etc. especially if there are only 2 players in one room any checks would be impossible against the host player anyway. To be honest, I am not making an MMORPG or something super complicated like that,  however I plan to have a multiplayer only game, similar to MOBAs, but much simpler with 2 to 8 players in one room(channel) with many games/rooms going on at one time. I want to keep persistent scores, statuses, etc., so cheating is something that must absolutely be dealt with as soon as possible and I it would take a great burden off I know how to build with it in mind. Ideally I'd like to have one server (or do I need a cloud service? Amazon EC2 maybe?) that handles the lobby and game logic and have users request to create rooms on that (would also get TNet to work on webplayer). But again, I do not know how this works and I don't think it's even possible and I'm just being naive.

So, sorry for the tl;dr but how should I approach cheating with TNet and build around that? I realize I kept going on and on but I'm not sure what I needed to elaborate on to sound clear. If there is something I should be more clear please tell me.

[dceevp]

the best way to protect the games and easy to implement, it is using anti-cheat toolkit (search in the asset store). This solition is in the user side, to implement some server side protection you need to make yourself.

[Patterrun]

the best way to protect the games and easy to implement, it is using anti-cheat toolkit (search in the asset store). This solition is in the user side, to implement some server side protection you need to make yourself.

I've actually checked it out before. It doesn't seem like a long-term solution which is what I'm looking for. At best it deters some novices with Cheat Engine that are curious.

[Manmax75]

Cheating is always a big issue and it affects every game on the spectrum from industry to indie. There's no easy solution to fix it, and the fact is that no matter how much you "cheat resist" your game, a user with enough technical skill will always be able to get around it in someway.

Now that we understand that completely preventing cheating 100% is impossible we can look at some things we can do, and some things we should do. For an authoritative server, cheat prevention can be easy as simply adding a :

1. if (!TNManager.ishosting)
2. return;
3.  

statement to some server-only logic, to ensure the client doesn't run the same thing or send anything to the server that it shouldn't be.

Keeping small things like this in mind when you code is a very basic but very efficient "future-proofing" method. Just iterate through you head "Who should be allowed to change this? should I have a check on to make sure that it changes right? What happens if the client sends this?" Etc.
Although wanting a complex long-term solution sounds like a logical idea, planning ahead right. It's really not worth it. My best piece of advice is to first make a game worthy of cheating in and then wait until people start cheating in it to make solutions for it. Otherwise you're stabbing in the dark because what if you create this complex anti-cheating system that took months of productivity and time only to turn out that you've changed some mechanic in your game where it's no longer required. Furthermore, when players start cheating you can address directly what needs to be fixed or secured down rather than once again stabbing at the dark.

While it seems like a logical investment to sort it out now, there's more other important things to work on. Always wait until you have a worthy game worth cheating on and cheating actually becomes a problem. It'll save you time and a lot of headaches.

[Patterrun]

Thank you for the informative reply, Max. I understand that cheating can not be eliminated, I just want to prevent it as much as possible via server authoritative setup. However, my confusion stems from not knowing how to set one up, especially in TNet, and seeing, reading, and studying about server authoritative setups. I read that some people easily setup a server authoritative setup with TNet and then some say it's not possible.

I also understand that I should not go for a complex solution right off the bat. That's not why I got TNet originally for anyway. However, I want to start with something simple so I can understand how to start building off it in case I actually do make a somewhat playable or even fun game instead of having to build scratch all over again if it happens, and honestly this is really bugging so much that I can not move on so it giving me headaches now. I thought I would start with a simple setup for movement where clients send input to one entity, and that entity processes the input and sends it back to the clients like some photon tutorial I read. It didn't really work out very well as I only got the clients to move somewhat okay but when the host client moves none of the clients see it moving. I might be able to fix it if I put more time into but, I don't even know if I am really doing it "right" (putting all this logic in one script).

I can understand the logic of what you said, and to use
(!TNManager.ishosting)
return;

for example to dictate that only the host client should be processing the input sent. However, what I don't understand, should I be doing this within one script, in Unity? For example, a movement script with the (!TNManager.ishosting) logic included in it? Would that be enough to do what I want, deter cheaters? Won't the host client also be able to still cheat though? Or am I misunderstanding and this logic somehow goes in the the code for the TNServer.exe (ServerMain.cs)? If it is not asking too much, perhaps a very, very simple example would be nice.

[ArenMook]

By default, TNet's server is just there to pass messages along to their intended destination. Think of it as a post office. If you want it to be authoritative, then you need to modify it to become aware of more than just how and where to send the packets. You will want to store game state, add logic that will handle certain packets, inspect others, etc. You will basically turn it from a simple post office into something more akin to the NSA.

Since all of this is highly custom to each game, which is why it doesn't make sense to have it be built-in.

The good news is that you have all of TNet's server code available for you, so you can modify it as you see fit. To start a server from within Unity, just call TNServerInstance.Start. Note what it does inside, how it starts up the Game Server -- you will want to modify exactly that (TNet.GameServer).

[foobarto]

The basic authoritative server could be implemented in TNet if there would be an option to make the TNet host prevent clients talking to each other (disable relaying messages). All clients would only be allowed to send messages which target would be the host. The host then decides what to do with that information - and yes, this is very game specific and up to the developer to decide.

I'm not sure if it's doable right now without modifying TNet source?

[djray2k]

Just sending information to the host is not an example of authoritative server, it just makes the host in control of everything. An authoritative server is similar, but every player is treated like a client, and the server itself is in charge of the logic and sending the current state of the game to others.

Arenmook is saying you can modify the TNServer to accomplish this.

[focus]

Hey guys!

Thanks for mentioning my Anti-Cheat Toolkit here. I know this topic is outdated a bit, but I'd like to shed some light on the ACTk application for any further visitors of this thread.
In first place, it was developed as a fast and easy solution against main type of cheaters - they use Cheat Engine and other tools to look up for variables in memory, they edit registry on windows to cheat PlayerPrefs, they use Cheat Engine's speedhack etc. And it does this job very well as I can see from customers response.
ACTk can be used as part of something more advanced since it provides simple tools to encrypt your data and a good code base to your own advanced solutions.

But ACTk itself is not a tool against advanced cheaters who will edit your IL bytecode, who will reverse-engineer encryption algos, who will use native or root level hacks to cheat Unity Player itself, etc.

So, if you're developing game with some server-based logic and you need robust anti-cheat solution - I'd suggest to not trust client at all, making lot of additional checks on the server side. ACTk still could increase cheater's effort to do his dirty job though.

But if you have no server support in your game ACTk will save you lot of time you possibly would spend on developing own similar anti-cheat solution anyway to get rid of lots cheated results in your highscore tables.

I hope this explanation will help someone to make right decisions while thinking on anti-cheat solution for some specific game.

[MCoburn]

Also consider learning internal/protected variables in the C# code. This protects the variables being modified from external binaries/assemblies, as per MSDN documentation.
You might also want to make public readonly values, and keep everything else private. For example:

1. public float currentPlayerMoveSpeed { get { return mySpeed; } }

As this will make a public float that can only be read from, not written to.

Cheat Engine is a pain in the bum in itself and really is only for wannabe hackers. You won't stop the most determined hacker, but one thing is for sure - your game has to be good enough to hack in the first place. A hacker wouldn't want to hack a really boring game, unless he/she had no other things to do with their time.

Unity Player itself have some sort of tamper protection, but then there's the hardcore hackers that are even disassembling the .assets files from the standalone player, making mods to files (changing textures and even meshes (!)) and then repacking them and getting the Player to accept the updated .assets file.

tl;dr: You can deter hackers but we can't beat them with a sure-fire solution.