[General] A fresh look at save/load security: Encoder 3

[Nestharus]

So, I designed a small save/load system for a friend recently. He told me that his code had been cracked by someone and he asked me to make a code with some security that would be nigh uncrackable.


So, the first thing I decided to do was generate a mostly unique checksum for each player based on the player name and a password. I decided to add a a password to scrambling too. These passwords are just added on to the player name (salt).

    private constant string CHECKSUM_PASS = "~9g/y*a\\"    //makes it impossible to get checksum with JASS w/o this code
    private constant string SCRAMBLER_PASS = "d0l\\!`l+35-t"  //makes it impossible to descramble via JASS w/o this code

Then I hashed and took the absolute value of the hash and divided the checksum one by 62 (division to avoid overflow when multiplying in).

So now every single player had a pretty unique scrambler and pretty unique checksum.

Another method would be to have a checksum min and max, like 2394353-9524378

What I'd do is take hash%(max-min)+min and get rid of the divide by 62.

Let's try it with something like a hash of 1529586364

1529586364%7130025=3761014+2394353=6155367

These MIN_MAX values ensures that players will have checksums between a range of values (not too big (long codes) and not too small (not secure).


So you can possibly expect an Encoder 3 that will take these new security measures. I will also update Encoder 2 to use the password values, but I obviously can't change the checksum styles as that's not compatible with 3 =).


Another Look at the Proof of the Power of Scrambling
Keep in mind that this demonstration scrambles in base 10. Scrambling is normally done in binary, meaning that the changes are much more drastic. Also keep in mind that the first bit is not normally scrambled in since that would just mean that it could possibly be replaced with a 0 (that's never good). 01 -> 1, lol, don't want to get a 0 in front ^)^.

Value- 123456789
Value in base 36 (a-z)- 21I3V9
Scrambling Key- 135

1,1
	213456789
2,3
	253416789
3,5
	258416739
4,1
	258146739
5,3
	258136749
6,5
	268135749
7,1
	268135479
8,3
	278135469
9,5
	278195463

Value in base 36 (a-z)- 4LMOZR

Comparison-
21I3V9
4LMOZR

 

[Dr Super Good]

And this stops me from modifying the map script or injecting values into the wc3 client how?

Map makers should just care less if someone does hack a code. 90% of the time the maps are so crap they diserve to have their codes hacked as playing them would be a waste of time. Thus it boils down to a design fault of the map maker.

Anyway, you could add physical protection, where the hash is also generated based on values obtained from how units displace in close proximity for example (how SWAT AM works).

 

[Geries]

The best way you could do is a randomly generated base characters I mean those alphabetic characters you use is randomized. Example you have 123456790 basically but your code regenerates it to 7281590326 and scrambles the code characters into the output string to be able to convert back values. The only problem is that you would have too long output strings and it just makes harder to hack but not makes impossible.

 

[Nestharus]

Yea, I was thinking about player based key sets too ^)^.

I'll probably update scrambler yet again to take a base to scramble in =D.

 

[x3GlikE]

Can't wait for it I am sure using in my ORPG Keep up the good work.

 

[Geries]

Yesterday I thinked a little more so I get that result it is impossible to make it more secure. A hacker with mid-bad logic would open the map in a jass editor so protecting fails here. Search the Encoder and the Encoder caller functions, copy them into a plain map then just play a little and it is able to make a new code with uber characters. It would take only 1~3 days. Based on the intelligence of the hacker . So what I want to say: I am sure that noone started hacking with the string that your encoder generates. They open the map so nothing will help. Only if the maps codes are unlogic things like

function aWca23rdAWEddfsdgvji takes integer MsfnioJbadRFe returns nothing

But this is not based on your encoder. Just make it faster, optimize it, and tell your friend that what I was saying in simplier way

 

[Nestharus]

But this is not based on your encoder. Just make it faster, optimize it, and tell your friend that what I was saying in simplier way

Eh, someone took the time to crack his code =P


Anyways, I'm having fun upgrading Scrambler ;D. I'm getting random results Oo, it's epic. I could make it a pseudo random number generator ;D.

 

[Geries]

All right. Have a good fun with it