Online Codes

Hi together,

as some of you may know, my game ( http://store.steampowered.com/app/339720/Debugger_316_HacknRun/ ) will go online on Steam next month. The game will teach the basics of programming and I want to show people how to program a small game with A8 and lite-c. Hopefully it will give A8 a new push! I talked with the developers of A8, we want to give the players the opportunity to buy A8 with a discount when they finish the last boss in the game.

Now the question: The team behind A8 will give me a list with discount codes and I will put this list onto my server. What would be the best method to load one code of this list into the game and delete it afterwards in the list?

Script examples would be nice!

I saw your post today and it started making me curious how this could be done using 3DGS. After playing around with a few ideas, I managed to create a working example for you.

Overview :
1) Connects to a PHP file that will scan a TXT file holding coupon codes. (Server Files)
2) It then saves the coupon code to a TXT file in the project folder for the player and then deletes the last coupon from the list. (Coupon will also show on screen)

You can download the example below and test it through my host. There are 50 coupon strings in the text file on my server. You'll be able to test it until the list runs out.

NOTE : Place findCoupon.PHP and coupons.txt on your server and change the couponDir string in the example script.

Hopefully this helps to point you in the right direction and allow you to get this working on your own server.

Coupon Code Example :
https://evoeon.com/freeDownloads/couponReader.zip
NOTE: Security not included.

Have a great weekend,
Brian Pressley (Evo)

Well, you'll need some security measures to prevent people from just getting all the keys.

True, security is important, but it's an example that's meant as a starting point and to give him an idea of how it can be done.

If someone knows the address to the current PHP/TXT examples, they can easily show the coupon codes in the browser. You'll have to work with the security to find a safe method to use it.

Either that, or find another, more secure, method. Working with online files, especially without a secure connection or password protection can be very unsafe.

I would recommend that you just send them a coupon code when they buy your game instead of trying to connect through 3dgs.

Thanks for the example!

Yeah, security would be important. Does someone know something about this topic?

Maybe you're right and we should send the user the code directly... I will think about this.

I would not load the code into the game.
Instead of that, the program should generate a number that indexes the list.
With that index can select a code.
For security and other reasons, the index should be encrypted.
At the selection stage must decrypt the index and get the code.
So, the whole process:
1. player win the game
2. the program generates the index
3. the program encrypts the index
4. the program sends the index to the server
5. the server decrypts the index
6. the server selects the code
7. the server sends back the code
8. the program shows the code

Just an idea. Use it, change it or throw it.

Just dont do it, it will take people with some more reversing skills minutes to hack your game and get all keys.
You'd need a method to check if a certain user already won a key and this is sadly not perfectly possible.

I think the public key encryption scheme is enough good for a game code list.

- You can simply create a cheat for the game to get a key
- You can log the webrequest and reverse the games functions to calculate the key
- You can do all of this as often as you like and steal all keys because there is no HWID check

I think you don't know how works the public key scheme.
And that does not forbid other technic combined with that, for example HWID.

If you dont link the data with the steam account or HWID your encryption and key mechanism is worthless.
You can CHEAT in the game itself which will generate nicely more keys for you.
And yes, I know how the public/private key machinc works

The best way is to hardcode ONE public key per game (and dif URL parameter to differ from) and give all customers a different version of the game containing a different public key.
I dont know if steam allows such a thing directly.

I didn't write about linking data (although i remarked anything can be combined), so i don't understand why do you write this word worthless.

Public keys has a benefit, they can be distributed in any number to any user. So because one is enough, should not exists the different public key problem.

That is right, different keys are more secure, but in this case wouldn't cause only one key big problems.

Well, would you look at that, the day I agree with Chaos has come!

Aku Aku, public key cryptography is a great tool for so many things, but not this. Just in general encryption is more or less worthless here, because in the worst case you can just do a replay attack and be done with it. Or, if it's slightly better do what Chaos says, open the game up in IDA (Pro) or whatever you have at hand and figure out where the encryption magic happens and just wire a jump in there from main.

The sad truth is this: If you ship something to a customer, consider it compromised. They can make 1000 mistakes trying to crack it open, but you only need to make one. And besides, it runs on _their_ CPU, and they can make _their_ CPU do whatever they want.

You will have a hard time as is trying to figure out who is legitimate and who isn't. Ideally you monitor exactly what happens and verify on the server what the user does and if it's legitimate or not. That's basically the MMO approach to no cheating, but it'll be hard sell for an single player game to spy on the user legitimately. Honestly, maybe do a raffle to subscribers to your newsletter and hope to god most people are too lazy to create enough email addresses to make a statistical dent for themselves.

If you are going to this, make it so it's just one key per purchase(tie it to the steam accounts), and assume that as many keys as the accounts that purchased the game will be reclaimed.

take a look at the Steam web API. You can get a key as publisher.