Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Winning at Candy Crush

stavros.io

Post reply on HN
Print view View original

71–80 of 148 posts

Re: Winning at Candy Crush

#71

Post by nacs »

togilvie wrote: post #37
StavrosK wrote: post #26

Earlier quoted context omitted.

They're probably generating the level with the seed. I don't think it's very useful, other than testing on their end (so they can check afterwards what the level was). By the way, if you liked this, there are more posts in that series: http://www.stavros.io/series/winning/

Cool - will check out the series. You could be right, but I think the seed is a lot more interesting. If you simply wanted to generate the level, you could use a random number generator on the device and wouldn't care about logging it. As you showed by varying colors, the candy distribution determines how likely the player is to win, whether they fall just short of clearing the level, etc. This will have a significan…

It is possible they do this.

They may not have done it at launch but as more and more people play and they collect the stats for each seed, I'm sure they can track how easy / difficult each seed is and send the seeds that they wish to do whatever objective they have.

Most of these F2P play games collect and analyze an insane amount of player activity and have sophisticated analytics that they then analyze to make the game more addictive or to increase player spending.

Re: Winning at Candy Crush

#72

Post by gknoy »

gibybo wrote: post #62
ry0ohki wrote: post #38

Earlier quoted context omitted.

I'd think you'd want to make a signed hash of each request, so the server can verify it came untampered from the client.

Candy crush does this, and circumventing it was one of the points of the article. It is hashed with a secret key from the flash client. He just extracted the key from the client and started signing the requests himself.

He signed the requests. I think they'd need some sort of way to ensure that the level's initial settings were also used.

Re: Winning at Candy Crush

#73

Post by jlees »

kens wrote: post #56

My game cheat story starts way, way back, playing Wizardry on the Apple II. In this game, you go through a dungeon, killing monsters and collecting treasure and experience. Fun, but slow going. So I found out where in memory these values are stored and started manipulating them, giving myself tons of experience and new treasures. Everything went fine until I put in an invalid treasure value which apparently caused so…

Neat story. I guess cheating by trial and error doesn't work so well when the impact of an error is physical...

I got into programming through cheating. When I was a little kid I wanted to win at some ZX Spectrum game - Treasure Island Dizzy or something like that. Fortunately, Your Sinclair magazine published a guide on how to PEEK and POKE your way to unlimited lives. That blew my mind, and I credit my interest in the inner workings of computers back to that experience :)

Re: Winning at Candy Crush

#74

Post by 0x0 »

smackfu wrote: post #50
josso wrote: post #41

Earlier quoted context omitted.

Wouldn't you need to decrypt, on a jailbroken device, it to get something useful out of the assembly? Or is that not needed for disassembling?

The binaries are not encrypted, they're just signed.

Is that a new thing? Last I checked, the executable was heavily encrypted in the code section..

Re: Winning at Candy Crush

#75

Post by ChuckMcM »

kens wrote: post #56

My game cheat story starts way, way back, playing Wizardry on the Apple II. In this game, you go through a dungeon, killing monsters and collecting treasure and experience. Fun, but slow going. So I found out where in memory these values are stored and started manipulating them, giving myself tons of experience and new treasures. Everything went fine until I put in an invalid treasure value which apparently caused so…

I guess its a half full / half empty thing. You wrote:

TL;DR: cheat at games and you will be punished

And yet I would haver written it, "Cheat at games and you will learn all sorts of cool things." :-)

Re: Winning at Candy Crush

#77

Post by pavel_lishin »

peeters wrote: post #46
Yhippa wrote: post #16

What's the best solution for this, managing game state server-side? Did they do it this way to offload storage and processing for scalability reasons?

I guess the first question is: why prevent people from doing this? In my opinion, with games like this the ultimate goal of the server is to make sure one person doesn't ruin someone else's fun. Seems fine to let them ruin their own fun.

A lot of people play games to compete with their friends. If everyone's just hacking to maximize their score, the legitimate players - and these are the ones who see the ads, and therefore are important to keep around - will leave your game.

Re: Winning at Candy Crush

#78

Post by pavel_lishin »

VMG wrote: post #12
Lionga wrote: post #8

it is crazy that a game that makes multi million dollars every day has no server side validation at all and just trust the client. crazy

Why spend unnecessary resources? People trying to cheat will find ways that are very hard to prevent. Which brings us to another question - besides hackers, who is interested in cheating these kinds of games? Probably people who want to impress their group of friends who also play the game. I smell a market opportunity here.

> Probably people who want to impress their group of friends who also play the game.

Or those who get stuck on one level, and find it more frustrating than fun to keep playing it over and over.

Re: Winning at Candy Crush

#80

Post by smartician »

Maybe I'm overly cautious, but in today's world, where even simple URL manipulation can be regarded as hacking, I would be very reluctant to post exploits like this. It's crazy, but this can be construed as wire fraud or computer crime:

18 U.S.C. § 1030(a)(4)

Whoever— (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period . . . shall be punished as provided in subsection (c) of this section.

"Protected computer" in this context means any computer that is connected to the Internet. And the value obtained would be unlimited use of the game, which would normally be a limited. True, that last part is up for debate, as it is possible to play the game without paying, but I wouldn't want to be forced to argue this in court...

Post reply on HN