One thing to remember is that all hackers aren''t just trying to cheat, some of them are actively trying to destroy the game. This is especially important in games where everybody plays on the same server (such as RPGs and online strategy games).

What I''m saying is, never trust anything that is sent to you. Of course you already knew this, but it''s worth pointing out. I had a bug in my game once that could have been used to attack the server. The problem was that I had a "move packet" which took a "direction" parameter, and if that parameter was 12 it would access a gap between two arrays and possibly crash the server. Additionally I had forgotten to make sure that the strings in chat packets where null-terminated (the idea that somebody would custom-build a chat packet to crash the server hadn''t come to my mind).


My Stuff : [ Whispers in Akarra (online rpg) || L33T WAR (multiplayer game) || The Asteroid Menace (another game) ]

Note that the lamers who only want to destroy everybody else''s game are really hard to defeat because they will always find new ways to wreak havoc. Of course the most obvious things are well-known, like attacking teammates in a TP game, blocking doors etc.
This is especially difficult to deal with because it''s got nothing to do with security - it''s about game design.

cu,
Prefect

Forgive my lack of 'up-to-datedness' with Win32 network architectures, but AcceptEx sounds very TCP specific... Just a thought.

The concept of 'UDP OOB' doesn't really get you anything - users can still waste system resources/bandwidth. I use something similar (called OOB incidentally ) in my UDP-based network lib, but it's used for a similar purpose to TCPs OOB mechanism.

I think prefect hit the nail on the head:

quote:

---

- it's about game design.

---

[edited by - fingh on January 22, 2003 6:27:08 PM]