[disc] secure high score tables

[jaytech]

I also was under the impression that Flash was insecure (and it is). However, as proven by Skill Jam it is possible to wrap a Flash game within a secure player and hide the swf entirely from the end user. In Skill Jam's case the wrapper communicates with the Flash game and the server to make sure score changes are legitimate. I am sure there are people out there that could hack it, but I think it would present a pretty good challenge.

The unlimited free games at Skill Jam don't use the wrapper, only the pay games. So to test this you have to sign up. They will give you a small deposit which you can use to play pay games where you can checkout the secured player.

[webgeek]

I'm familiar with their secure player, but never really used it. If you end up needing to use another player for security, it's time to stop using Flash. It's biggest advantage is the player ubiquity.

[jaytech]

That is true, however if money or prizes are at stake people will be more willing to download a new player. In the case of high stakes gaming, ubiquity isn't as much of an issue. Accessibility is, and making the game web based allows for great accessibility.

[ilya_cat]

Originally posted by webgeek
Interesting. Looks like it's an AS obfuscator. Sadly, this doesn't help with someone changing variables in memory. They don't need to see the variable name, they just need to tweak the value directly.

It's not an AS obfuscator. I'll use a different tricks, which couldn't disassembled back into ActionScript. Now you can use only one, first protection method - some times later you could found more different methods, including native bytecode obfuscation of variables.

[BitSky]

Sadly, this doesn't help with someone changing variables in memory. They don't need to see the variable name, they just need to tweak the value directly.

- i have good experience in protect variables in memory.

now we will protect "score" variable
steps:

1) create 2 nested mc: _root.score_mc and _root.score_mc.score_mc
2) draw something in in _root.score_mc.score_mc
3) create timeline with length == (possible maximum scores) + 100
4) add code to _root.score_mc.score_mc:
// property:
this.addProperty("score", function () {
var val1 = this.getDepth()+this.rand1, val2 = this._currentframe+this.rand2-1;
return val1 == val2 ? val1-this.rand1 : _root.unloadMovie();
}, function (val) {
val = Number(val);
this.gotoAndStop(1+val+(this.rand1=random(98)+1));
this.swapDepths(val+(this.rand2=random(98)+1));
});
// init:
this.score = 0;
// check:
this.onEnterFrame = function() {
var k = this.score
};

now you have variable not changed in memory

second step:

you need send variable to server. you can use check summ or hash http://genable.com/aso/tevas.html
in both cases you need protect a code from viewers:
http://as-protect.com (free)
(if not, somebody can view check summ algorithm or hash secret word)

and,
add your own protection methods

try hack your game using http://www.artmoney.ru (free)
try see the code using asv or flasm

enjoy

(sorry, english isn't my native code, i hope you can understand me. thanx)