Anti save-edit plugin idea

[thekenbaum]

I recently came across a website that allows users to cheat by editing save games (http://www.saveeditonline.com/), you can change variables, gold, weapons, items, and a lot more; and this could be problematic for a lot of developers since it's so easy to find (Quite literally, google 'rpg maker mv save editor' and it's the first result).

I came up with an idea to make it harder to pull of the save edit and get away with it but since I have very little java script experience, I can't actually code the plugin.

Alright, so the plugin will pick up when ever someone is saving or loading a save file; when it detects that someone is saving; it acts as normal but drops a copy of the save file somewhere else (say \data for an instance), maybe it'll even change the name of the copy so data snoopers won't find it as easily.

When someone loads a save file, before actually loading, the plugin will compare the save file with it's copy and see if there's any differences, if there are no differences, everything is fine and dandy so it loads the game like normal; but if there is a difference, something will trigger (common event, refusing to load save file, replacing save file with a copy of the copy, exc).

This plugin will make the easiest form of cheating in a rpg maker game more difficult, but even with this I wouldn't call it impossible since it's rudimentary and not the most secure thing in the world, but hey, something is better than nothing.

 

[TheoAllen]

Tried the website, uploaded my save game data, and interestingly shows gold, parameters, etc. How they know if I assign those parameters in a certain variable in my save data? I assume the website know the default save data structure. Simply changing the save data structure should be enough for a mitigation though

Edit: Although, on a slightly different perspective

Spoiler

Unless it's an online game, i don't think it's wrong to cheat an offline game anyway

 

[Poryg]

@thekenbaum Will only work against rookie cheaters.
I always like it when I'm challenged by anticheat measures. However, hiding another savefile nearby is just as easy to crack as the default savefile¨and in fact completely pointless. I've already cracked several games through finding out where the backup was and simply editing both (not rm games, but...). Back then it was pretty simple though, just a hexa editor was enough. Nowadays it is more difficult, because the data is often obfuscated and harder to find...
But anyway, if you wanted to hide a savefile, it would be better somewhere outside of the game folder. But unless you hide it in a visible place, you can lose credibility in terms of security, because who knows what kinds of files you could hide...
So I would drop the idea of this plugin. Because yeah, people can cheat on games... But some have a good reason for it, some games deserve to be cheated on and some people don't have time to spend with leveling.
Of course I always try to restrict huge cheating in my games (hardcoding anticheat checks), but I give some acceptable thresholds of cheating to make sure the players can still speed up the game progress if they need to, but to not be a total bully.

 

[mlogan]

I've moved this thread to Plugin Requests. Please be sure to post your threads in the correct forum next time. Thank you.

 

[doranikofu]

I heard rmmv uses a very common way to obscure the savefile so it is easy to crack. Ordinary users can cheat by changing gold easily. Changing item needs time for them to find all item IDs.
I heard that you could try to use a less common library (or something like that, I am not expert in this), so the common ways to un-obscure savefiles become difficult.
I don't think you have to worry about it too much unless you want to do online games. It is a matter of how you see this. If someone wants to cheat in your game it also shows that you made a good game that other people really want to play it.

Also if you deploy to android, etc. It is really hard to access the save files unless you root your phone.

 

[Poryg]

Indeed, mv uses a very simple way to obscure the save files. lzString 64bit compression. I looked at it today and by reverse engineering I found out the whole process, however there is no need for that, since you basically just need to parse the json and decompress it (if I oversimplify it). If I then save the output to an outside file, I can edit that as I please, then I just compress it and replace the old savefile.
The worst thing which makes any savefile protection hard is the fact that scripts are always developed uncompressed. So no matter what kinds of measurements you take, the files can still be opened and unless you really obfuscate the code, there is no good defence against cheating in MV saves.

 

[Zeriab]

Singleplayer game or offline game? Save file security doesn't really matter.

One could consider adding a checksum number like CRC32 or SHA-1 to the savefile number. Modify the save file system so that it does not accept savefile where the checksum number is invalid. Not a secure solution, but that doesn't really matter. This is rather misdirection. Also, non-scripters are quite unlikely to work around it, at least until a general tool is created by a scripter.

If you really want to go for a more secure option guard the save data on your own servers. Make sure the player never actually get their hands on it. Spend a lot of effort and money on something that's totally not worth either.

 

[ChampX]

I wouldn't worry too much with people cheating on a single player game that accounts for the majority of MV games. Cheating will always happen no matter how clever you could be and there are many scriptable solutions one could do such as the one Zeriab provided.

Or you could also think about things from a design point. One thing to discourage cheating is to make it so players wouldn't generally want to cheat or to just make it pointless. For example, money could be easily obtainable without an annoying grind that editing the save file would make that pointless. You could even go as far to not use currency in your game. Sure they could modify it, but why bother?

Some solutions could also incorporate both a programmable solution and a design solution. My game personally has stats automatically calculated by the game and I wrote a script for that as that was just the design solution I came up with mechanically. As a side effect, when I ran a dummy save file under the save editor linked, modifying party member stats had no effect as my game just essentially recalculates and replaces those numbers anyway making that modification to the save file pointless. I didn't intend this, but it worked out that way.

And if players already paid for your game and really want to go out of there way to cheat instead, I say let them and not spend too much time/effort/money on an anti cheat system. Players cheating isn't really harming anyone else and as I said you're better off just making them not want to cheat or to make cheating pointless as opposed to trying to really fight it.

 

[Poryg]

True words. There is only one case where I can 100% say I don't cjeat - hard diff. But on lower difficulties, especially if I don't consider the game to be good, I feel no restraints to cheating. On the other hand, I'm not against restraints against too much cheating. For example, a cheating threshold of 5. Only up to 5 levels gain, only up to 50000 gold gain,... Basically anything that still is a cheat, but doesnn't break the game.

 

[ChampX]

Right, everyone will always have their opinions on cheating of whats acceptable and what isn't so it is best to just somewhat design toward a middle ground. A little bit of effort, but not extreme.

Besides if a generic MV cheat engine doesn't work but someone creates one specifically for your game, well that is free marketing and exposure and the person at least likes your game enough to bother. If your game was terrible enough, people would just stop playing period as opposed to just cheating to reach the end. I would rather someone cheat my single player experience over just flat out quitting altogether, although I would prefer overall they play through it normally of course

 

[Poryg]

Yeah. I use my mouse for cheating too, even in multiplayer, but never to give myself an unfair advantage. For example I have a script that left clicks every 64 ms. My mouse has reaction time of 2 ms, while delay between two commands is 11-16 ms. If I wanted, I could just push it all the way down to 11 ms. That would be inhuman clicking, while 64 ms, even though it is not the easiest, is still manageable and I could do it. But I just use my mouse to pass and get rid of one annoying instance, not to cheat through
Although truth is, I don't call that cheating. My mouse comes with software that can create certain scripts (like the mouse clicking or even mouse movements), so to me it is like when you buy a scientific calculator and others have a normal one. It has enhanced capabilities and I exploit them. But others call it cheating.
But that is off thread.

 

[Engr. Adiktuzmiko]

Your players can also just cheat while the game is running, no even need to cheat/edit the savefile itself

 

[ChampX]

The measures needed to counter cheating while the game is running (cheat engine or whatever else) are probably not worth the trouble for the typical offline single player game experience that 98% of the RPG Maker MV games are built upon.

 

[Shaz]

Do you really want to put a lot of time into doing something that will prevent a minority of players taking an action that (in their opinion) will allow them to enjoy the game more? Personally I'd rather put time into doing something that will make the majority of players enjoy it more, and if a few feel they need to cheat to make it worthwhile, let them.

 

[silicaandpina]

Cant you just change

"toolbar": false,

to

toolbar": true,

in package.json and then you can just open the JS console and do stuff like

$gameParty.giveGold(1000000);

anyway, i saw one RM game that did cheat detection by having an event in a bunch of maps that would check if you got there before your suppost to (like say this map is only accessable when switch: canAccessMap is on, you could put a check in the room to see if canAccessMap is on and if its not run some code *throw a gameover or whatever*)

 

[Poryg]

@silicaandpina Toolbar is deprecated since nwjs 0.13

 

[silicaandpina]

@silicaandpina Toolbar is deprecated since nwjs 0.13

it seems to still be there for me in MV 1.6.1 though. . . maybe there using an older version ?
you can allways inject your own JS by editing plugins.js to make it include your own anyway~ or just edit index.html and add a <script> to the end erh

 

[slimmmeiske2]

silicaandpina, please refrain from necro-posting in a thread. Necro-posting is posting in a thread that has not had posting activity in over 30 days. You can review our forum rules here. Thank you.