I should have specified more. The online server gives the user a KEY per character only if they want to save stats online (bragging rights). This however is outside the request of the OP, so completely unnecessary in this post and I'll not comment on it further.
Copying a save file from a desktop to a laptop it would be assumed you have closed the game anyway. Thus setting a "Saved" state inside of the save file for that character and it is not hacked (thereby allowing a move of the file). If you are in the middle of playing the game, then save to your laptop. Yes, it would be considered in a "playing state", then when loaded the game sees this and invalidates the character for online stats on that second save. Before you ask, this isn't reported to the online server, only when a player tries to upload the character.
I suppose a real hacker could "try" subverting the CRC check, remove the mode/throw and intercept the game state as it is being written into the character save file. These are all good points you made, I'll be sure to obfuscate this CRC location and set up a honeypot variable to draw in attempts at hacking. Touching that variable in memory will allow the character data to send up to the stats server "Stupid hacker and wipe character account".
The scrap-scrap-scrap on your old hard drive only happens if you are making active changes to the character. You take a turn, your gamestate is queued for saving. Why wouldn't you want an up to date save? I don't complain that firefox caches pages from an RSS feed in the background while I surf the net or that windows itself pages out memory. I have had my laptop overheat once and was pissed when I lost an hour of gameplay on other games.
Yes, there are some holes in the implementation and I appreciate that you brought up some ideas on what to protect against. It gave me further ideas on how to prevent hacking attempts.
Show Posts
