Unity3D to PHP Security Issues - c#

I have a question I am stumped on.
Okay, this is for a game of mine in Unity3D.
To make this make sense in terms of what people normally play.
Let's say the player has 500 Gold in their account (saved on database).
And the player earns 243 gold by doing some kind of task, how could the game
(Unity3D) tell the PHP file they earned specifically 243 Gold?
Because here's where the issue lies,
In Unity3D there's a class called WWW.
It allows you to send some sort of string to a PHP file.
int currentGold;
string goldToSend = currentGold.ToString(); // Only using that for example.
WWWForm form = new WWWForm();
form.AddField("NameOfPostRequestInPHPFile",goldToSend);
WWW www = new WWW("website.com/PHPFile.php", form);
Now as you can see, I am in a pretty big dilemma, being you can't trust the client with anything, how would one actually send a random gold amount from the client side to the PHP to then put into a database.
The issue I am facing is, how can one really make a PHP understand what's going on in the game without the client actually telling it a thing, and being you can't trust the client, how can the client actually tell the PHP to load, use this data and then put it into the database.
I thought about using hashes an stuff, but then that still brings up the problem client side.
Lets say
if(sentGold == 243){
string hash = hash01;
// Change it to hash1000 (to get 1000 gold).
}
if(sentGold == 1000){
string hash = hash1000;
}
As you can see, using if statements clearly wouldn't work either, because then the hashes could just be changed locally to fit their devious attempts. Plus it looks like garbage to had 20K if statements.
I know it's impossible to entirely stop hacking. But at the same time, if I do something i want to do it right, not half-a**ed if you get what I mean?
If you've made it to this point reading my help message.
I really appreciate the time you've put into reading it,
it means a lot to me.
Now, if there's some other technology or hints you might know that could help me with this, or heck even a tutorial on it (i've been looking for days), but I'm still deadlocked because nobody is addressing the fact that yeah they might use secret keys and so forth, but they are failing to address that the string they send can be easily tampered with. All they gotta do is change for 243 to 9999999999 and then they are rich.

You can't trust the client? Correct.
But...You are the captain of this ship. So your server need to be smart enough to detect the cheating.If a certain task in game gives 200 gold, you can send the reference of that task along with the value (200,"SomeTask"). Now if client tries to send (10000,"SomeTask"), server would consider it cheating. You might say that client can earn variable gold based on how good they perform the task, in that case you can have a max-limit value for every task and check before adding the gold to database.
And never send total gold from client to be saved in database. Client should only be able to send newly earned gold and will gets back total value.
For Example:
Database: 2000 gold -> Game: 2000 gold
Game: POST (130,"pickupjewel");
Databse: if (130 <= MaxValue("pickupjewel")) [TRUE] -> SUCCESS
Database: 2130 gold -> Game: 2130 gold
Game: POST (999999,"pickupjewel");
Databse: if (999999<= MaxValue("pickupjewel")) [FALSE] -> FAILURE
Database: 2130 gold -> Game: 2130 gold
I hope this helps. Let me know if you have any specific issue.

Related

Incorrect decimal placement in financial application

I'm fairly new to programming and started learning C# and this is my first project. I'm struggling to figure out why strange and seemingly random issue is occurring. This is a fairly simple trading application. Basically it connects to a websocket stream and receives live price data from the exchange and then evaluates the price in real time and performs some actions. The price is updated hundreds of times per second and operates without issues and then all of a sudden, I will get a price value that is thousands of dollars off the actual price that was sent from the exchange. I finally caught this occurring in real time. The app had been running for 11 hours or so without issue, then the bad value came through.
Here is the code in question:
public static decimal CurrentPrice;
// ...
if (BitmexTickerStreamIsConnected)
{
bitmexApiSocketService.Subscribe(BitmetSocketSubscriptions.CreateInstrumentSubsription(
message =>
{
foreach (var instrumentDto in message.Data)
{
if (instrumentDto.Symbol == "XBTUSD")
{
BitmexTickerStreamLastMessageReceived = DateTime.Now;
decimal LastPrice = instrumentDto.LastPrice.HasValue ? Convert.ToDecimal(instrumentDto.LastPrice) : CurrentPrice;
CurrentPrice = LastPrice;
}
}
}));
}
These are the values from the debug after a breakpoint was hit further down:
instrumentDto.LastPrice = 7769.5
LastPrice = 7769.5
CurrentPrice = 776.9
The issue is that CurrentPrice seems to be for some reason shifting the decimal to the left by one place. The values coming in from the websocket are fine, its just when CurrentPrice is set to LastPrice that the issue happens.
I have no idea why this is happening and seems to be totally random.
Anyone have any idea why this might be happening or how?
Thank you for your help!
There's two common causes:
Market data, due to how fast it's updated, will occasionally give
you straight up bad data depending on the provider. If you're
consuming directly from an exchange you need to code for this. Some
providers (like OPRA) will filter or mark bad ticks for you.
If you see this issue consistently it's due to things like tick size
or scale. Some exchanges do this differently, but effectively you
need to multiply certain price fields by a certain scale. Consult
with the data provider documentation for details.
If this is seen very rarely, you likely just got a bad price. Yes, this absolutely will happen on occassion and you need to be prepared for it, unless you want to become the next Knight Capital.
In all handlers I've written (or contributed to) there's a "sanity check" to see if the data is good. Depending on what you're trying to accomplish, just dropping the bad tick is fine.
Another solution that I've commonly used is alternate streams of data (usually called "A" and "B" streams or similar). If you get a bad tick on one stream, use the other.
That said this is not directly related to the programming language, but at the core it's handling quirks with the API/data.
Edit
Also beware of threading issues here. Be sure CurrentPrice isn't updated by multiple threads at once. decimal is 128-bit base 10 floating point, and that's larger than word size currently (32 or 64 bits).
You may need to synchronize the reads and writes to it which you can do in a variety of ways. The above information still applies, though.

Track a simple Firebase Event

I want to track a simple Firebase event in my mobile game - When the player hits a score of 25, I want them to be labeled as an "active_player"
The code I got from my programmer looks like this, but it doesn't track in Firebase. Any thoughts of what could be wrong?
public void ReportScore(int score)
{
Social.ReportScore(score, GPGSIds.leaderboard_total_icons,(bool success) =>
{
Debug.Log("Score reported: " + score);
if (score == 25)
{
Firebase.Analytics.FirebaseAnalytics.LogEvent(
Firebase.Analytics.FirebaseAnalytics.EventSelectContent,
new Firebase.Analytics.Parameter("active_player", score));
}
}
}
If I understand the question correctly, you want to create an audience of players whose scores are above 25. What the code there does is log an EventSelectContent event with a parameter "active_player" whose value is 25.
To create an Audience of people who have logged that event with that parameter.
I don't think this is the best way to achieve your goal though. You can create your own events. For example, you could replace the above line with:
Firebase.Analytics.FirebaseAnalytics.LogEvent("active_player");
at which point you could create an audience of everyone whose logged that event without diving into parameters.
But what I think you really should do is set a user property. This way you can easily categorize all the users who've achieved this goal. You could say something like:
FirebaseAnalytics.SetUserProperty("gamertype", "active");
to mark a user as active.
Finally, I'm not sure what your overall goals are, but you may actually be better served by Firebase Predictions. A prediction that's automatically calculated for you is "churn" or "a user about to stop playing your game" or "not churn" which is basically your active player. Predictions do need more daily active users before they're active, but they have the potential of being the most beneficial if you're trying to take pre-emptive measures to retain your users. I think this Medium post can shed more light on why you might choose predictions over just an analytics property.
Hopefully this helps!
--Patrick

Bigquery internalError when streaming data

I'm getting the following error while streaming data:
Google.ApisGoogle.Apis.Requests.RequestError
Internal Error [500]
Errors [
Message[Internal Error] Location[ - ] Reason[internalError] Domain[global]
]
My code:
public bool InsertAll(BigqueryService s, String datasetId, String tableId, List<TableDataInsertAllRequest.RowsData> data)
{
try
{
TabledataResource t = s.Tabledata;
TableDataInsertAllRequest req = new TableDataInsertAllRequest()
{
Kind = "bigquery#tableDataInsertAllRequest",
Rows = data
};
TableDataInsertAllResponse response = t.InsertAll(req, projectId, datasetId, tableId).Execute();
if (response.InsertErrors != null)
{
return true;
}
}
catch (Exception e)
{
throw e;
}
return false;
}
I'm streaming data constantly and many times a day I have this error. How can I fix this?
We seen several problems:
the request randomly fails with type 'Backend error'
the request randomly fails with type 'Connection error'
the request randomly fails with type 'timeout' (watch out here, as only some rows are failing and not the whole payload)
some other error messages are non descriptive, and they are so vague that they don't help you, just retry.
we see hundreds of such failures each day, so they are pretty much constant, and not related to Cloud health.
For all these we opened cases in paid Google Enterprise Support, but unfortunately they didn't resolved it. It seams the recommended option to take is an exponential-backoff with retry, even the support told to do so. Also the failure rate fits the 99.9% uptime we have in the SLA, so there is no reason for objection.
There's something to keep in mind in regards to the SLA, it's a very strictly defined structure, the details are here. The 99.9% is uptime not directly translated into fail rate. What this means is that if BQ has a 30 minute downtime one month, and then you do 10,000 inserts within that period but didn't do any inserts in other times of the month, it will cause the numbers to be skewered. This is why we suggest a exponential backoff algorithm. The SLA is explicitly based on uptime and not error rate, but logically the two correlates closely if you do streaming inserts throughout the month at different times with backoff-retry setup. Technically, you should experience on average about 1/1000 failed insert if you are doing inserts through out the month if you have setup the proper retry mechanism.
You can check out this chart about your project health:
https://console.developers.google.com/project/YOUR-APP-ID/apiui/apiview/bigquery?tabId=usage&duration=P1D
About times. Since streaming has a limited payload size, see Quota policy it's easier to talk about times, as the payload is limited in the same way to both of us, but I will mention other side effects too.
We measure between 1200-2500 ms for each streaming request, and this was consistent over the last month as you can see in the chart.
The approach you've chosen if takes hours that means it does not scale, and won't scale. You need to rethink the approach with async processes that can retry.
Processing in background IO bound or cpu bound tasks is now a common practice in most web applications. There's plenty of software to help build background jobs, some based on a messaging system like Beanstalkd.
Basically, you needed to distribute insert jobs across a closed network, to prioritize them, and consume(run) them. Well, that's exactly what Beanstalkd provides.
Beanstalkd gives the possibility to organize jobs in tubes, each tube corresponding to a job type.
You need an API/producer which can put jobs on a tube, let's say a json representation of the row. This was a killer feature for our use case. So we have an API which gets the rows, and places them on tube, this takes just a few milliseconds, so you could achieve fast response time.
On the other part, you have now a bunch of jobs on some tubes. You need an agent. An agent/consumer can reserve a job.
It helps you also with job management and retries: When a job is successfully processed, a consumer can delete the job from the tube. In the case of failure, the consumer can bury the job. This job will not be pushed back to the tube, but will be available for further inspection.
A consumer can release a job, Beanstalkd will push this job back in the tube, and make it available for another client.
Beanstalkd clients can be found in most common languages, a web interface can be useful for debugging.

Unity NullReference when trying to use ParseFacebookUtils to log in to parse

I'm not to familiar with the SO user tags, so I hope that this works: #aaron
This is the closest question that I could find that relates to my issue, but it's not exactly the issue. (I tried Google, Bing, and SO's own search.)
https://stackoverflow.com/questions/25014006/nullreferenceexception-with-parseobjects-in-array-of-pointers
My issue: I have a Unity Web-Player game that interfaces with both Facebook and Parse. after resolving many issues in it, I have it to where it will easily connect to Facebook, pull in the user's profile information and picture. It then attempts to connect to parse to log the user into parse to retrieve their game related data (like high scores, currency stats, power ups, etc.) and when it tries to do that, I get a NullReferenceException. The specific contents of the error message is:
"NullReferenceException: Object reference not set to an instance of an object
at GameStateController.ParseFBConnect (System.String userId, System.String accessToken, DateTime tokenExpiration) [0x0001a] in C:...\Assets\Scripts\CSharp\CharacterScripts\GameStateController.cs:1581
at GameStateController.Update () [0x0011f] in C:\Users\Michieal\Desktop\Dragon Rush Game\Assets\Scripts\CSharp\CharacterScripts\GameStateController.cs:382"
The code that generates this error message is:
public void ParseFBConnect(string userId, string accessToken, DateTime tokenExpiration)
{
Task<ParseUser> logInTask = ParseFacebookUtils.LogInAsync (userId, accessToken, tokenExpiration).ContinueWith<ParseUser> (t =>
{
if (t.IsFaulted || t.IsCanceled)
{
if (t.IsCanceled)
Util.LogError ("LoginTask::ParseUser:: Cancelled. >.<");
// The login failed. Check the error to see why.
Util.LogError ("Error Result: " + t.Result.ToString ());
Util.LogError ("Error Result (msg): " + t.Exception.Message);
Util.LogError ("Error Result (inmsg): " + t.Exception.InnerException.Message);
}
if (t.IsCompleted)
{ // No need to link the user to a FB account, as there are no "real" (non fb) accounts yet.
Util.Log ("PFBC::Login result reports successful. You Go Gurl!");
// Login was successful.
user = t.Result; // assign the resultant user to our "user"...
RetryPFBC = false;
return user;
}
return t.Result;
});
if (user.ContainsKey ("NotNew"))
{ // on true, then we don't have to set up the keys...
Util.Log ("User, " + user.Username + ", contains NotNew Key.");
}
else
{
CreateKeys (); // Create Keys will only build MISSING Keys, setting them to the default data specifications.
user.Email = Email;
user.SaveAsync (); // if we have created the keys data, save it out.
}
}
It is being passed the proper (post authenticated) Facebook values (FB.UserId, FB.AccessToken, FB.AccessTokenExpiresAt) in that order. I'm using FB Sdk version 6.0.0 and Parse Unity SDK version 1.2.16.
In the log file, instead of any of the debug.log/Util.log comments, it does the "Null Reference" error (above), followed by "About to parse url: https://api.parse.com/1/classes/_User
Checking if https://api.parse.com/1/classes/_User is a valid domain
Checking request-host: api.parse.com against valid domain: *"
And that is where it just stopped. So, I built a simple retry block in the Update() function to call the ParseFBConnect() function every 10 or so seconds. Which, seems to only fill up my log file with the same error sets. After searching across the internet for help, I tried changing the FB.AccessTokenExpiresAt to DateTime.UtcNow.AddDays(1) as others have said that this works for them. I cannot seem to get either to work for me. When I check the Dashboard in Parse to see if it shows any updates or activity, it doesn't, and hasn't for a few days now. The Script Execution Order is as follows:
Parse.ParseInitialzeBehaviour -- -2875 (very first thing)
Facebook loaders (FB, Editor, Canvas, etc) -- -1000 to -900
GameStateController -- -875
...
So, I know that the Parse.ParseInitializeBehaviour is being loaded first (another result of searching), and I have tracked the NullReference down to the Parse.Unity.dll by changing where the login method is stored; The GSC is on the player (the Player starts in the splash screen and remains throughout the entire game). I have also tried placing the Parse.ParseInitializeBehaviour on the Player gameobject and on an empty gameobject (with a simple dontdestroy(gameObject) script on that). And, I have my Application ID and my DotNet Key correctly filled in on the object.
When I first set up parse, and on the current production version of the game, it can successfully create a user account based off of the code snippet above. Now, it just breaks at the trying to parse the url...
So, My Question is: What am I doing wrong? Does anyone else have this issue? and does anyone have any ideas/suggestions/etc., on what to do to fix this? I really just want this to work, and to log the user in, so that I can grab their data and go on to breaking other things in my game :D
All help is appreciated!! and I thank you for taking the time to read this.
The Answer to this question is as follows:
backend as a service - Bing
Ditch parse because it doesn't work well with Unity3d, the support (obviously, judging by the sheer number answers to this question and other questions from people that need help getting it to work) is extremely lacking, and most, if not all, of the examples to show how to use it are broken / missing parts / etc. I see this as a failure on the part of the creators. I also see it as False Advertising. So, to answer this question - PARSE is a waste of time, cut to the chase and grab something that does work, has real, WORKING examples, and that is maintained by someone that knows HOW TO PROGRAM in the UNITY3d environment.
A great example of this would be the Photon Networking service, App42 by Shephertz.com, Azure by Microsoft, etc. With the overwhelming number of answers to this, if you exclude PARSE, This should have been a no-brainer. I've included a Bing Search link, you can also do a quick search for Gaming Backends (you'll find blogs and reviews.)
I suggest strongly, that you read the reviews on these services, read the questions (and make note of whether they have been answered, or, in the case of Parse, if they simply closed the forum rather than answering their customers)... And, just bounce around through the examples that they give for using their products. If they show how it works, and expected results (like the MSDN does) you'll have a lot better and a lot easier time getting it work.
FYI - My game now has all of the back end integrations, saves/creates/gets users & their data, has a store, and is moving right along, since I dropped PARSE.
To make things correct, I WAS using Parse 1.2.16 for unity, and the Facebook for Unity SDK 6.0.0... I tried Parse 1.2.14, with the same results, and I tried both Unity 4.5.2 and 4.5.3. My opinion of Parse is based off of their documentation, these 2 API versions, and the very long days that I pulled trying to get it to work. I then added in the fact that NO ONE here answered this question AT ALL (Sadly, Stack Over flow is Facebook's preferred Help/Support forum. They even say in their blogs, help documentation, etc., that if you have an issue - post your question on Stack Overflow.com with relevant tags. Which, I did.)
Oh, and the final star rating of Parse (to clarify it) is "-2 out of 5" -- That's a NEGATIVE 2 stars... out of 5. as in, run away from it... far, far away. Just to clarify.

Can I search memory for a specific object structure?

Last night I took CheatEngine for a ride, and I found a structure in the game i currently play. The game has 4 characters, each with "health" and "mana", both of these are 4 bytes (int). Is there a way I can scan the application to find the first occurrence?
What I found was that health of player 1 was located at 2DC2E72C, and I'm going to short it to "72C" since the other players health comes very exact after that.
Player 1 health: 72C
Player 2 health: 81C
Player 3 health: 90C
Player 4 health: 9FC
After some handywork with my trusted microsoft calculator, I found that it is 240 bytes between each players health. Players mana is 4 bytes, placed right after health, so the structure is:
000 Player 1 health
004 Player 1 mana
240 Player 2 health
244 Player 2 mana
and so on.
So my question is, could I search for this pattern in the applications memory? The pattern would be something along the line of: 2x4 bytes, 240 bytes, 2x4 bytes, 240 bytes....
If you have a text file containing the memory contents you could use regular expressions to search for the pattern you want. Boost has a good library for regular expressions.
I think there won't be a managed way to do that.
However, CheatEngine is an open source program, that does the same
http://www.cheatengine.org/
Maybe you could check out the source code and figure out which API calls you need to achive the same with C#
Update: I see, you already mentioned CheatEngine, overlooked it the first time.
I found this article on CodeProject http://www.codeproject.com/Articles/15680/How-to-write-a-Memory-Scanner-using-C
Looks simple
There was a cheat program back in the day called FreeCheese if I remember correctly. The way it worked was something like this :
Take search value from user input
Scan game's process memory for any values that match users input and
store found addresses
Ask user to change the value ingame and take
new value as input
Rescan addresses from step 2 and discard those that don't match the new value
Repeat steps 3 and 4 until an address (number of addresses) is found that always reflect the changes specified by the user
Ask the user for a new value and write that value to the addresses found
Step 6 is tricky since you will need to do type / size checks to make sure you can actually apply the new value.
Happy cheating :)

Categories