Online high scores

Check out cURL and libcURL: http://curl.haxx.se/

There's quite a bit of documentation to go through, but the C++ binding (http://curl.haxx.se/libcurl/cplusplus/) has some nice samples that should get you started with the HTTP Requests that you need to make for the online high scores.

It took me a few days (less than a week) to implement high scores in my game while taking a full load (17 credits) at a university. But there is a few "gotchas" that are best learned by experimenting with the code samples.

I'm curious about this problem too. Its easy enough to make a CGI or server-side script manage high scores in an SQL table, and make the client program open a socket to the webserver on port 80 and use the usual HTTP protocol methods to GET and POST high scores (to partially answer your question).

In a closed-source client, you can use a magic number hidden in the code to verify the client's score submission. But how can you make this moderately cheat-proof, using an open-source client - and not restrict players to use a specific build? Maybe someone can answer this for me.

I've just thought about this stuff now and I would usually research the idea before resorting to the forums. But since someone's already started the topic, I might as well ask now.

Quote:

Original post by EnemyBoss In a closed-source client, you can use a magic number hidden in the code to verify the client's score submission.

Well, not particularly effectively. You need to do a little more than that to discourage all but the most pathetic cheaters.

Quote:

But how can you make this moderately cheat-proof, using an open-source client - and not restrict players to use a specific build?

Maybe have a different high score table for each build. Don't allow people who compile their own client to use the official client high score table. Have a different (unpublished) high score security mechanism for official binary builds.

I can't see another way of doing it.

Bear in mind that there are certain techniques that are effectively undefeatable, e.g. attaching a debugger and modifying the score in-memory before it gets saved.

So don't try too hard.

Needless to say, I wrote a game with an online high score table which is trivial to hack, and it has not been hacked yet.

Make sure there isn't a prize for the highest score.

Mark

With rBlocks, I kind of hacked it and had it write the highscore to an encrypted file. When they were satisfied with their score, they uploaded the file through a website and then PHP would decypher the file and add the highscore to a MySQL database where everyone could then see their results. Unfortunately I had to take the highscore uploader down while I did some maintenance on my site, but you can still see the highscores.

I just realized its impossible to make an open-source client that can't be re-built to allow players to cheat in the game. The high scores table should really only support officially released builds. The issue here isn't just about transparency.

Thanks,

Quote:

Original post by EnemyBoss I just realized its impossible to make an open-source client that can't be re-built to allow players to cheat in the game. The high scores table should really only support officially released builds. The issue here isn't just about transparency.

You could include a certain number with the highscore to verify it and when releasing the source, just change the number.

Yup, a number or a secure identifier scheme exclusive to the build release. Thats what I and I think markr mean by official binary builds. The client can still be open-source, but unofficial builds can't post high scores on the official server. Others can of course build and host their own highscores tables, then build and release clients to support them.

Well, what id do for a nice online high score list is use a PHP file of some sort, post the results to from the application, and store them in a MySQL database. Of course you would have to develop a very secure way of doing this by perhaps encrypting things and setting a cookie, along with some sort of ID system that corresponds with the score you have. Otherwise people would simply hack there score.

Quote:

Original post by wyrzy Check out cURL and libcURL: http://curl.haxx.se/ There's quite a bit of documentation to go through, but the C++ binding (http://curl.haxx.se/libcurl/cplusplus/) has some nice samples that should get you started with the HTTP Requests that you need to make for the online high scores. It took me a few days (less than a week) to implement high scores in my game while taking a full load (17 credits) at a university. But there is a few "gotchas" that are best learned by experimenting with the code samples.

Thanks, looks quite powerful. I'm having a bit of trouble compiling/linking my code with the binary though. I get the error:

The procedure entry point ANS1_STRING_data could not be located in the dynamic link libeay32.dll

The documentation talks about needing to install it first but I can't actually find the various install files it talks about (mingw32.bat, curl-config etc). Are there any other more basic HTTP libraries?

Do you really need one though? HTTP is a very simple protocol. Especially if you're just using GET to post your scores. You should be able to get by using Berkley sockets. Infact, if you are just using GET, and you're on the Windows platform, couldn't you just have the game open your encoded URL in the default browser? I mean the scores are going to be posted on the web anyways right?

Quote:

Original post by EnemyBoss Do you really need one though? HTTP is a very simple protocol. Especially if you're just using GET to post your scores. You should be able to get by using Berkley sockets. Infact, if you are just using GET, and you're on the Windows platform, couldn't you just have the game open your encoded URL in the default browser? I mean the scores are going to be posted on the web anyways right?

Good point I could do it that way but it'd be a nice feature if it could display the highscores in the actual game. I've had a go with using WinSock but I've run into problems with that as well (see related thread). I'll have a try with Berkley sockets, sounds interesting.

Thanks for your help EnemyBoss. I liked your java breakout game by the way.

Thanks. I just remembered, there is also SDL_net. Its an easy to use, cross platform socket wrapper library for making and managing TCP connections. It was designed for implementing most network related features used in games. I doesn't actually depends on SDL itself.