Even though it doesn't have a winning / losing condition, I had coded an automated bot[0] to draw for me in Doodle or Die[1]. Stopped using it when people started complaining though. It was supposed to be quick and dirty, that's why it's a windows forms application. But of course I kept improving it for a while. After implementing a very basic plug-in system, I realized I was spending too much time on it =) Here's an example drawing from a friend of mine, using my tool: http://doodleordie.com/c/EGXBBJeMU45#2
Winning at Candy Crush
61–70 of 148 posts
Re: Winning at Candy Crush
#62What's the best solution for this, managing game state server-side? Did they do it this way to offload storage and processing for scalability reasons?
I'd think you'd want to make a signed hash of each request, so the server can verify it came untampered from the client.
Candy crush does this, and circumventing it was one of the points of the article. It is hashed with a secret key from the flash client. He just extracted the key from the client and started signing the requests himself.
Re: Winning at Candy Crush
#63Wow! I'm surprised to hear that their production servers output a full stack trace.
Agreed, it reminded me of how the BitKeeper protocol was reverse-engineered by simply typing "help" in the TCP connection to the server:
http://lwn.net/Articles/132938/
Tridge noted that this sort of output made the "reverse engineering" process rather easier. What, he wondered, was the help command there for? Did the BitKeeper client occasionally get confused and have to ask for guidance?
Re: Winning at Candy Crush
#64Earlier quoted context omitted.
http://www.sikuli.org Is my GOTO GUI scripting language for game scripting. Graphic templates are fuzzy matched. Actual scripts are python. Inbuilt OCR. I can do that kinda thing very fast. Its really awesome and put of MIT
Cool. I used AutoIt for similar stuff: http://www.autoitscript.com/site/autoit/ Scripting is some dialect of BASIC and also has OCR.
Don't advertise that on the forums!
P.s. I have to say that as an MVP ;)
Re: Winning at Candy Crush
#65What's the best solution for this, managing game state server-side? Did they do it this way to offload storage and processing for scalability reasons?
In one puzzle game I worked on, we recorded all the user's moves and sent them back to the server. Not too big for something like Candy Crush, and allows you to check the user actually played the game.
Of course, that doesn't stop the next obvious steps (implementing a full simulation, or controlling the game through the GUI), but neither of those can be stopped.
Re: Winning at Candy Crush
#66Earlier quoted context omitted.
I'd think you'd want to make a signed hash of each request, so the server can verify it came untampered from the client.
Candy crush does this, and circumventing it was one of the points of the article. It is hashed with a secret key from the flash client. He just extracted the key from the client and started signing the requests himself.
True, although it seems not all of the calls are like that, for example the number of lives.
Re: Winning at Candy Crush
#67It looks like the author is decompiling the Flash SWF for the Facebook game. Would there be an equivalent way to do this for games on an iPad/iPhone without rooting the device?
Isn't the Flash version using the same back end and API calls as the iOS version?
iOS version works offline, so I imagine everything is local to the device.
Re: Winning at Candy Crush
#68I don't know how valid it is now, but in July of 2011 I reverse engineered some aspects of Zynga's Words with Friends and put it up online: https://github.com/v64/fiend
The most interesting part was the way they decided to do the random generation of letter tiles. At the start of the game, each client was given the same PRNG seed (in the case of Words with Friends, the PRNG was a Mersenne twister), and when tiles needed to be drawn from the bag, instead of having the server tell you what tiles you received, you would use the preseeded PRNG to randomly draw your tiles from the available pool.
Of course, as your opponent is also doing this with the same preseeded PRNG, this also allows you to determine what tiles your opponent has, and what order the tiles will be drawn in for the rest of the game.
Re: Winning at Candy Crush
#69I had a somewhat similar story a few years ago with Bejeweled 2 (except that I didn't seek a way to cheat, just came across it).
I wrote it up here: http://timotheeboucher.com/on-writing-laconic-error-messages... but the gist of it was that their score submission endpoint required a checksum, but the error message if the checksum was wrong was:
Re: Winning at Candy Crush
#70What's the best solution for this, managing game state server-side? Did they do it this way to offload storage and processing for scalability reasons?
The best thing to do is basically to simulate the entire game for each player on the server side and verify every action the player does but this involves a lot more code and is also server intensive for many games.
There also things like signing each request and such but ultimately, the client can't be trusted and will always be able to cheat in some way (like automating clicks and actions via GUI scripting).