Mass file system examination

[slopy]

Hello any kings of the algorithm in the audience. Heres a trick that I need my program to do, but I am not able to think of a very fast, low cost solution for.

I want my program to monitor files and check their contents against pre-definded values. When it starts, I need it check maybe about 1000 files to make sure that they either, do not exist or exist but do not have illigal changes made to them. And after that, I need my program to watch the entire folder heirarchy to make sure they do not insert or create new files while my program is running.

I know vb .net has a filesystem watcher control, but that only solves one of my problems and I do not know if its very fast.

The program is going to be running in the background of a video game, so the program needs to run fast, so fast that there will not be a noticable lag at startup, or during the game.

If any of you play with steam a lot, you can get a better grip on my project. In half life 2, the source engine allows a lot of editing to take place in the game files. It reads probably about 70% of what it does from files outside the engine. Which is good for modders, but horrible for a game like CSS where any player can copy a 1 color skin into a directory and have all the Terrorists running around bright pink. What I want my program to do is monitor the folder structure, and make sure these files firstly do not exist, and secondly make sure they never do exist by performing systematic scans of the file structure.

The best thing I can come up with is do a few crc's on the files I want to check, but this does not stop people from creating new files, I can have the program scan with it all hard coded, but thats really really slopy. So I have been on the hunt for some open source folder scanners or the like that will fit my needs.

So if you can think of a good way to accomplish this with minimal effort cpu side, please post. And it does not have to be strickly vb code. I just need some general brain storm ideas.

Thank you

 

[cjard]

i dont think youll manage it. you can make it very hard, but eventually someone will look at is as a cracking project..

you can insist on inteernet connectivity for this and have the game engline query a central server as it is loading filees and calcing the CRCs but even then, someone will proxy it to return "thats okay" for all the files..

 

[cjard]

ever heard of punkbuster?

 

[slopy]

I am not really making a program that catches cheaters, I am just making a program that will make sure they have the correct versions of files.

 

[ManicCW]

can you use FileSystemWatcher component?

 

[cjard]

if you must use your own system, then you dont have to scan for people making their own files.. just scan the directory for files and use the same logic the game would when loading them.. i.e. in Quake 3 (what im familiar with) files were loaded in alphabet order, so you chould have your genuine pak0.pk3 and then a zpak.pk3 with files in that would replace the genuine ones.. your logic could work out which genuine files would replace the originals...

another trick, maybe, is to find out how the guys at www.sysinternals.com wrote FileMon to monitor open and close operations of every windows file.. it involves hooking into windows itself, but you can then see every file that the game is accessing - build a list, and lazily scan the files on low priority

you are going to need some kind of refernce as to what the scan hashes should be though..

 

[slopy]

Thats a good idea, but in order to do that I would have to make operating system specific code, and then theres the chance that if it was updated my entire system would break.. Plus with vista comming out soon, I would have to make it not available on that os until a new filesystem hooker is found.
It was a good idea though.

 

[cjard]

i dont think its os/specific - filemon works on every windows os from 98 on... all out of the same zip file, i cant see that they would write more code for every os...


however, the task you have asked about is neither simple nor widespread - PunkBuster are perhaps the only guys in the world that do what they do. You'd be better off providing a service where you control what files the users have by making a game launcher, that checks their files, downloads latest or uncorrupted ones before they play and checks throughout.

Youre going to have to tie the client to the server somehow - e.g. the server has a code that changes regularly, the game checks for the code and checks for the client running locally also knowing the code. if anything misses several times then it went bad, the server disconnects the game. i.e. your client program is a bit ,like a dongle - it has to be running for the server to allow play. if the user uses your client to launch the game then switches to a cheater mod, youll know..

end of the day, youll probably end up reinventing punkbuster.. i dont know pricing of punk.. but you can check it out

 

[brudvik]

Punkbuster is in theory a good system, but practically it doesn't work as it
should have been working. It catches cheaters alright, but it merely
catches people without any real programming knowledge. Good cheaters
will find way to attach their cheats with running game files, so if you want
to make a good system then you need to make sure that not only do you
need to verify game files, but you also need to verify running processes,
check other running processes and keep updating your database with
information about processes that might be cheat related, as well as known
crc values of attempted cheats.