Android Games: Strategies to Defeat Memory Editors for Cheating

Question

I have simple game with 2 variables to store the score and best score:

int HightScore, CurrentScore;

I save the socre by SharedPreferences

static SharedPreferences app_preferences;

//Save hight score example
SharedPreferences.Editor hightScore = app_preferences.edit();
hightScore.putInt("HighScore", temp);
hightScore.apply(); // Very important

On Android OS, there are alot of memory editor tools, such as: GameCIH, DaxAttack, HaXplorer, SB Game Hacker, GameGuardian (working on Android version up to Kikat 4.4) and Game Killer (fully compatible with android Lollipop)

I hope some one help me figure out some strategies to prevent my variable form being modified by those tools?

I'm really appreciate your helps. Thank you very much in advanced.

Answer 1

Generally, I don't really know any tools or anything for that.

But as a temporary solution, if you REALLY want to get it prevented under any circumstances, why not create two variables which have to be added to be the new highscore?

But you would always have to work with these two values together then. I wouldn't recommend it.

ALSO, it could happen that the compiler notices the two variables being added all the time and it creates one variable out of it after all.

You can also check for installed packages.

That's probably the best way.

Answer 2

Because they're doing a http intercept, there's unfortunately nothing you can do. I've even found setting the max score for the leaderboard in itunes connect has no effect.

A game I worked on never serilaised the score to disk - so it couldn't have been changed there - and set max score to 30m. Yet the leaderboard was full with IntMax scores within hours of launching.

You can also set up your own server and use proper authentication and encrypted channels to upload score and then just compare whats in your server vs whats in GameCenter... You still need to clean up the leaderboard, but at least you will know what to remediate and which users to put on blacklist.

I'd refer to MalluHacks API

Answer 3

Calc hash from saved data and store it. On load calc again and compare with stored. If do not match - you have illegal changes.

Erase all to zero state.