MMO Mapserver Boundaries

How is your map defined?
How do players move, can they fly, use vehicles, jump, ...?

What shape is your map? You might be able to split it into triangle shapes and then shoot a ray from your player to the ground and see whether or not there was a hit with a zone triangle.

Currently the game is made with portals and gates. You are in a town and you can choose 3 words from a wordlist and it teleports you to the map. The map could be any shape. This way I don't even have to create swap zones to get from one zone to another.

@etsuja: Thanks for that, I'll try that

Do an initial client-side verification (ray tracing, physics collision detection, etc). Then, every so often, have the server verify and check that the player is in a valid location. If it's not, "something bad happened", and the server forcibly either kills the player or moves him to a "safe" spot.

This way, hackers will be able to get through walls but not for long until the server detects the error (and flags the account, perhaps) and resets the player. Regular users will still be OK because of the client-side detection.

Quote:

Original post by Grafalgar Do an initial client-side verification (ray tracing, physics collision detection, etc). Then, every so often, have the server verify and check that the player is in a valid location. If it's not, "something bad happened", and the server forcibly either kills the player or moves him to a "safe" spot. This way, hackers will be able to get through walls but not for long until the server detects the error (and flags the account, perhaps) and resets the player. Regular users will still be OK because of the client-side detection.

is that really going to work though? even being able to walk through walls for just a single second will open the game to rampant cheating. walking through a wall may only take half a second, then your back in legal map bounds and the server never noticed

instead, the client makes a *request* to the server to move, the server verifies where the client wants to move, and then gives it the OK, telling the client his position. the server should step the physics and check all collisions at a fixed rate.. then the hard part is making it all look good, and in MMO, making it scalable...

What MMO's have server side validation of things like that?

Quote:

Original post by Megahertz What MMO's have server side validation of things like that?

Silkroad Online is one that I know does first hand from having done lots of reversing on it. I assume you were asking that of graveyard filla's post. I won't bore you with details of how their game is structured unless you really want to hear it.

Quote:

Original post by Megahertz What MMO's have server side validation of things like that?

I would think any MMO which wouldn't want people walking through walls & other players and stuff... so.. probably all of them.. ?? [lol]

Quote:

Original post by graveyard filla Quote: Original post by Megahertz What MMO's have server side validation of things like that? I would think any MMO which wouldn't want people walking through walls & other players and stuff... so.. probably all of them.. ?? [lol]

Funny enough, this is far from true on an alarming amount of MMORPGS. A lot of free to play MMORPGs have such movement bugs to where the server does not properly verify movements, it's all done on the client's side. Even Warhammer has had a long standing speed and jump movement hack since beta. The Final Fantasy MMORPG has such hacks as well, but they are server detected and players are quickly auto-banned.

The underlying cause for that is because its easier to program it that way. Rather than have to develop an extensive system for the server, a lot of places rely on the client doing all the checks and keeping the player in check. The golden rule of networking is never trust the client, but very few games actually follow that rule! It's harder to do the right thing and so much easier to do the wrong thing and as a result, cheating prevails in a lot of games due to this and it is not something that can easily be fixed once it's exploited.

Well, aside from technical considerations, depending on the scope of you "M" MORPG, you may or may not want to bother about security. I'm no expert at all, it's just that doing a hacker-proof game sounds like ten times as much work as doing a game that just ignores the existence of hacker, and achieving the later already doesn't sound bad at all!

Good luck!

why bother making a game that as soon as it becomes popular players will become gods??

i can't say i'm surprised to read what you wrote Drew, but i'd bet most commercial MMO's do have movement validation checks.. at least any of the mature/popular ones..

Quote:

Original post by graveyard filla why bother making a game that as soon as it becomes popular players will become gods??

Well, you've got to finish the game first before it even has a chance to become popular. You'll never do that if you spend all your time trying to be 100% hacker-proof. Better to finish a non-hacker-proof game than to be forever tweaking your anti-hacker code and never actually release anything!

Having said that, I think it would still be in your best interested to be at least thinking of the future...

Okayy.. never thought this thread is getting this kind of popularity... I think I know how to do it now. There are 2 steps like Grafalgar said.

At first, the client checks movement. Every second the server checks player position from 50 players. Server calculates the maximum movement distance possible and places player to the last possible movement point if he's on map, if not, he kills the player and flags him as possible h4xx0r (muhahaha)...

Now it could be possible to make some rules after how many attempts a player gets kicked or banned.

I know I shouldn't make the game 100% hacker-safe, but it should be safe enough so players cannot fly around the maps. The golden rule of never trust the client is not only in games, it's also on web and basic validation should be always done. I don't want some hacker to compromise one of my servers.

Quote:

Original post by graveyard filla why bother making a game that as soon as it becomes popular players will become gods?? i can't say i'm surprised to read what you wrote Drew, but i'd bet most commercial MMO's do have movement validation checks.. at least any of the mature/popular ones..

Wow doesn't do any server-side checks. It's actually possible to teleport yourself all around the world, even under the maps. Extreme abuse of this however will end with a ban.

However, exploit of this sort, outside of a certain gold-spammer incident, has never been an issue. There have always existed much simpler ways to gain access to some locked areas, which relied on flaws in logic or world design itself.

The reason is simple. Who cares if player wants to walk beyond the end of map. The important thing is that they cannot enter an instance they aren't supposed to, or be somewhere they aren't allowed to be. There are very few areas where this applies, and in almost all cases it involves a door to an instance or something like it.

Quote:

Every second the server checks player position from 50 players. Server calculates the maximum movement distance possible and places player to the last possible movement point if he's on map

If your world is based on collision maps or something that you can call ground, then split the ground into polygons. Whenever a client requests they moved, check if they are allowed to go from one polygon (zone) to another. If not, cancel the move.

This ensures that on server, player is never in an invalid location. Depending on world design, such test can be very cheap.

Player can then hack as much as they want - server will never accept them at new position, and they will never be able to perform an action in the zone they hacked into. Even though the client may be showing them in a different location, all actions are performed by server, where player never changed places.

Any good MMO should never trust the client. Bots or alternative clients should all be on the same level as the normal one, and things we don't want to happen should be prevented at the protocol level.
We can then conclude there is no good 3D MMO at the moment.

Collision detection, obviously, should be done on the server. Even better, the client should only know about what it should know, but that's more difficult (visibility tests etc.).

Preventing the user from falling off the map is a simple collision detection problem.

Quote:

Original post by Antheus Wow doesn't do any server-side checks. It's actually possible to teleport yourself all around the world, even under the maps. Extreme abuse of this however will end with a ban.

I'm certainly not contradicting you in the general case, but I have been on a community-run WoW server that had a nasty habit of punishing players who ran down steep slopes or dropped off short cliffs, because it sees that the player "isn't jumping" (he's on the ground at one polling point and at the next 2 seconds later) but they still moved farther than they could have gone at their character's walking speed (because they fell three-quarters of the way), so it would force a logout, and when you next logged in you'd be back where you were when you last logged in and with half a level of EXP deducted, plus the normal penalties if you happened to be dead and searching for your corpse when you got kicked.

The upshot; if you're going to do server-side validation, you have to do it correctly. And you should do server-side validation.

I think the reason games like WoW do not do certain checks server side is that its just too computationally expensive to do so or I'm quite certain they would be doing it.

You can certainly do checks to see of the player has moved farther than they should have with in a certain amount of time as those typically just require you to compare the distance traveled with a known max value.

Checking to see if a player has walked past a wall requires a lot more math to be brought into the picture.

Quote:

Original post by loufoque Any good MMO should never trust the client. Bots or alternative clients should all be on the same level as the normal one, and things we don't want to happen should be prevented at the protocol level. We can then conclude there is no good 3D MMO at the moment. Collision detection, obviously, should be done on the server. Even better, the client should only know about what it should know, but that's more difficult (visibility tests etc.). Preventing the user from falling off the map is a simple collision detection problem.

damn, i'm surprised to hear that WoW has this.. don't they have player housing in the game???

I'm sure there are some MMO's that did this though. UO probably did it, and I'd bet 20 bucks that the virtual world engine that hplus from the forums here works on (I'm pretty sure they made 'there' and do government projects, forget the companies name right now) has real stepped physics on the server side, and sends update states to client... at least i could swear him explaining it that way in the past...

my 'MMO' may have only made it to the demo phase, but god damnit, no one could cheat!!!!!11 [grin]

I don't see strict server side validation as being realistic, especially for an MMO. If you have hundreds, maybe thousands of players moving around an extensive world then checking for collisions for every player against their surrounding objects is just too computationally expensive. Not only that, but you'd have to keep the collision geometry of the entire world as players would be spread out. It just seems unrealistic.

Client-side movement and basic server sanity checking doesn't seem so bad to me. players that do use some speed hack or teleporting trick (or reporting false positions then the server would just send the client the corrected position, no?

thebookofhook