10 ms·

I hacked Magic the Gathering: Arena for a 100% win rate

504 points by danielwmayer 3y ago

ljlolel 3y ago
This is buried but fascinating: magic the gathering is turing complete, probably even more complicated than simply uncomputable , and possibly the most complicated major real world game https://arxiv.org/abs/1904.09828 https://arxiv.org/abs/1904.09828
onetimeuse92304 3y ago
Pure client side game logic... I once developed a small game. Sometimes, for responsiveness, you need to implement game logic on the client. But nothing says you can't redo the logic on the server and that's what I did. It can be hard on a real time game like FPS or RTS, but there simply is no excuse for a card game. I think for a card game like this you really want to send no more information to the client than a real player would see. So for example, rather than send the cards that the opponent has in hand, just send the number of cards that he has -- no more and no less than what you would see in a real game situation. It goes without saying that any actions sent to the server are only speaking for you and not your opponent. So no, you should not be able to declare forfeit for your opponent. You should only be able to say "forfeit!" which the server interprets as your forfeit because you are the only player you have power over.
- mkonecny 3y ago
  The author explicitly mentions this is how the game is implemented in the first 1/3 of the article
- lewisedc 3y ago
  I'm pretty sure the article declares the game was programmed in exactly the way you are suggesting it should be, where you only get the information required at the time it's needed, and you only send actions for yourself. The exploit was that one was able to set up a second client and connect to the currently ongoing game but in the opponents seat, once this was done they could sene actions as the opponent including the forfeit action.
- Ensorceled 3y ago
  > It can be hard on a real time game like FPS or RTS, but there simply is no excuse for a card game. As the article clearly states, the game play is entirely server side. The author exploited a problem in the authorization and game connection code, not any client side game logic. > It goes without saying that any actions sent to the server are only speaking for you and not your opponent. So no, you should not be able to declare forfeit for your opponent. You should only be able to say "forfeit!" which the server interprets as your forfeit because you are the only player you have power over. You are simply repeating how exploit that the author found works.
- PawgerZ 3y ago
  Reading the post explains the post.
Sweepi 3y ago
"I was totally surprised by this, because it means that a (mostly) fully-functioning bot capable of playing arbitrary games of Magic: The Gathering has a small enough footprint to run locally on your machine" I dont get that. Maybe I am missing something. Lets say, the MTG AI was so intensive to run that it would be unreasonable to run on the customer's machine - then I wouldn't run it on the server either, since it would be quite expensive (and bot games in card games are usually not pay per play). Also, servers are not magic - most of them run on the same x86 CPUs as the local machine, with a lower clockspeed than their desktop counter parts (but higher than (most) notebooks). Therefore, the only way to archive a lower Bot turn timer compared to running locally would be to use significantly more cores than the customer (usually 4-8, hence 8-16 allocated cores per player?!). Sounds like a nightmare, especially during peak concurrent player hours/days! If the CPU Player does not support multi-core, running locally should be faster in any case.
- Ensorceled 3y ago
  >> "I was totally surprised by this, because it means that a (mostly) fully-functioning bot capable of playing arbitrary games of Magic: The Gathering has a small enough footprint to run locally on your machine" > I dont get that. Maybe I am missing something. Lets say, the MTG AI was so intensive to run that it would be unreasonable to run on the customer's machine - then I wouldn't run it on the server either [...] They said "footprint", not "processing power". The bot's rules engine is small enough to run in the memory footprint on older iPhone or Android devices, a server could have a lot of memory dedicated to holding a state machine or rules engine and still use very little processing power to execute the engine for any particular request.
- lima 3y ago
  MTG is a very complicated game with a complex ruleset.
  - apetresc 3y ago
    His point wasn't that an MTG bot should be easy to run, his point was that it shouldn't be any easier/cheaper to run server-side than client-side. But to address your point, while that is true, Sparky itself plays with very basic decks, and plays even those very poorly. The goal of Sparky is to introduce players to the rules, not to be a competitive MtG agent; playing badly is intended. I wouldn't be surprised if Sparky's code is actually just a bunch of very simple heuristics (maximize your mana utilization this turn, attack with any creature that can trade evenly or better, etc).
partomniscient 3y ago
The thing that weirded me the most in the article out was seeing the 'goto IL_1894' statements in C# code. It brought back memories of error handling in VB6, and was rather unpleasant. I presume this is being done for performance reasons?
- neonsunset 3y ago
  This is simply how C# decompiled from IL looks like - sometimes you can turn IL-level gotos back into control flow idioms and sometimes not.
deleted 3y ago
[deleted]
erfgh 3y ago
MTG is not very interesting when actually playing it. Most of the game is building your deck. Thereafter the deck mostly plays by itself.
- mgdev 3y ago
  Building deck = programming Playing = executing
- alfons_foobar 3y ago
  There are drafts/sealed, you know...
wbecher 3y ago
well... WOTC is a small indie game company
dbttdft 3y ago
[dead]
araes 3y ago
The TLDR is a little too short. - Decompile C# for Sparky bot [a], rewrite Sparky to be a substitute online opponent, connect Sparky vs you online as if you're connecting a human in a match, have Sparky auto-concede and jack your win rate. [a] Note I thought was interesting was: "C# is also really nice because it utilizes metadata tokens to associate elements of the compiled code with their human-readable names, which are still stored in the compiled .NET assembly. That means I can see all the function, variable, and class names that the developers wrote when they wrote their code." Which means its super easy to reverse engineer.
chupasaurus 3y ago
In League of Legends there was a division-by-zero bug with a certain champion and item which caused server to kick all players and then crash. Because the exploiter was being kicked last, their team gets the win while opponents get Loss Prevented because the game doesn't have a normal result.
- MaxikCZ 3y ago
  If the enemy doesnt get loss because game doesnt have normal result, winning team should not get win aswell...
  - chupasaurus 3y ago
    IIRC it was added to the game because of serial leavers (and cheaters, which is funny with this exploit) and then sometime later applied to deal with server instability issues.
- BlorpyHuman 3y ago
  [flagged]
- deleted 3y ago
  [deleted]
squeaky-clean 3y ago
That's very fun. This is a "simple" enough exploit that I sent it to my MTG group chat, I bet they can understand it without needing to understand any programming jargon beyond client/server. I'm simultaneously surprised something this simple worked, and also not surprised at all. He does make a good point, this is an effective way to provide a practice bot and not need to make many server side modifications. I understand why they did it this way. The problem is they didn't make any server side modifications haha. Edit: so far 3 of them have given me a lol or laugh emoji. This is excellent writing.
- danielwmayer 3y ago
  Thank you!
- adw 3y ago
  It’s shown up in one of the bigger Magic-podcast Discords too. You nailed the writing on this. And “always validate your inputs”!
chrisweekly 3y ago
Kudos for a very well-written and educational post!
w-ll 3y ago
Lol, i recently got into MTG again with MTGA. I did a quick decompile as its a Unity game and not il2cpp (not that it would have protected it that much) but I found some fun stuff too. Keys for their epic launcher build, some undocumented apis. I never wanted to use it to cheat, i really just wish there was a battle log. What matches I won, what I lost, view the battlefied of a finished game, etc... Gonna check this out, but hopefuly its patched quick.
- tayo42 3y ago
  I'm pretty sure this exists. I think it's player log. There are a bunch of apps that do tracking that use it iirc
  - blargpls 3y ago
    There is mtgatool, an open source app to read the logs and generate a history of played games and some statistics: https://github.com/mtgatool/mtgatool-desktop https://github.com/mtgatool/mtgatool-desktop
- Namahanna 3y ago
  https://mtgaassistant.net/ https://mtgaassistant.net/ is the most common one I know of for collecting your play data.
- danielwmayer 3y ago
  This vulnerability was patched before I wrote the post - I disclosed it to MTG. In terms of viewing your history, you should check out https://untapped.gg/en https://untapped.gg/en. I have talked to them a bit and they essentially do what you want. They take most of their info from MTG's debug log, which you can find in MTGA's application directory, so you could also make your own tracker as well if you want. They talk about it on their site: https://help.hearthsim.net/en/articles/3620440-how-do-i-supply-my-untapped-gg-companion-or-mtga-log-file https://help.hearthsim.net/en/articles/3620440-how-do-i-supp...
  - 59nadir 3y ago
ProjectArcturis 3y ago
I love the accessible yet insightful level of detail in this post. One thing I don't understand is, in the case where you connect your bot during a real match, 1) why does the game allow someone to join mid-match, and 2) when the bot resigns, why does that count as your opponent resigning? If it's creating a 3-player game, Player 3 conceding shouldn't also make Player 2 concede.
- virgildotcodes 3y ago
  1) I'm guessing this is how they handle people reconnecting after a disconnection. You terminate the old connection? 2) The bot replaces player 2, then submits a resignation. The server registers it as player 2 resigning.
  - ProjectArcturis 3y ago
    Ah, makes sense. I guess they just assume that any client who is requesting to sit in that seat is authorized to.
    - Ensorceled 3y ago
      Yeah, the seat is the problem. There are a LOT of security systems that depend on assuming the holder of a large random string, like a guid, is the proper holder of that string so it's not necessarily a bad thing for the match. They should have made the seat index random as well though they are probably now just checking credentials.
    - knallfrosch 3y ago
      Looks to me like they only verified match ids, not the seats at all.
  - Ensorceled 3y ago
    Yes, I had my desktop version of MTGA hang and when I connected to the match with my iPhone it immediately disconnected the desktop.
- 3y ago
r1ch 3y ago
This takes me back to the Diablo 2 days when you could connect an open server character (LAN) onto the official bnet (internet) servers by reusing the same connection packets. Since open server data was all saved locally, you could create all kinds of items that aren't supposed to exist and the official server would still accept them.
althea_tx 3y ago
Great post. Thank you for highlighting that hilarious code comment.
hfuaiobfa 3y ago
Congratulations again for the top story, Daniel! I was hacking on MTGA since you posted this article and spoke a little about that with you on GitHub [0]. For anyone interested, I'm _inactively_ working on an unofficial client of MTGA which does hardly anything meaningful for now. The vision is to provide some automation for playing ranked games and stronger bot opponents. Sadly I was distracted lately away from the project and am still puzzled how to make a good UI to see things clearly. I can't even estimate when it will be barely useful. Beside that, I'm still very interested in any game hacking story of Daniel and anyone else! Please tell me more about how to spot such bugs, how not to worry being banned after such hacking, how to `disclosing the bug to them` like @aethros commented, how to structure an unofficial card game client, and other stories. Thank you! [0] https://github.com/MayerDaniel/mayerdaniel.github.io/issues/1 https://github.com/MayerDaniel/mayerdaniel.github.io/issues/...
extraduder_ire 3y ago
> I would have thought that a game as complex as MTG would require a lot of overhead in terms of creating an AI opponent. But nope! You can actually check out all of the logic for Sparky, including a few places in the debug UI where WOTC developers reached a corner case that they felt was not worth implementing. I don't blame them - MTG is a beast of a game to try to have full coverage for! This is a huge understatement, since the game is nearly (no infinite loops) Turing complete, and people have a lot of fun with that. I assume there's a lot of work already done on AI strategy for it though. The post title should probably have a "Show HN:" on it too, since you're posting it yourself.
- dmurray 3y ago
  "The game can be used to encode a Turing machine" is not at all the same as "it is difficult to write a program that can play a legal action in every situation". It's the latter that seems to be difficult for the bot authors.
  - jprafael 3y ago
    > "it is difficult to write a program that can play a legal action in every situation" This is trivial (just forfeit). The hard part is figuring out the best possible action to select from. MTG is particularly hard at this because: * Some actions are only allowed in certain conditions (e.g. in response to, in a specific phase, etc) * Actions vary significantly not only in their effects but also in their inputs (some require targeting a creature, a player, an opponent, a card in hand, a card in exile, a name of a card that could exist). Some have a varying list of inputs (target many creatures). This variance makes it hard to encode the action space. * The state space is huge. It is not only determined by the cards in play, but is also affected by the meta-game (to play optimally players have to play in a specific way to avoid getting countered by a card that could be in play by the opponent, because that card is legal to play and is commonly used by decks that look like what the opponent is playing). * Technically the state space is also infinite because you can create infinite loops that keep creating more and more triggers/creatures/etc.
    - 3y ago
BillyTheMage 3y ago
Wish we could hack the card-shuffler for MTGA. I can't remember the last time I had a match where at least one of us didn't have either no land or nothing but land.
- minimaxir 3y ago
  This goes all the way back to the original Magic the Gathering: Online in 2001. tl;dr it's actually random unlike real shuffling: https://forum.nogoblinsallowed.com/viewtopic.php?f=15&t=11845 https://forum.nogoblinsallowed.com/viewtopic.php?f=15&t=1184...
  - ugexe 3y ago
    MTGO does not use the same shuffler as MTGA
- mproud 3y ago
  There’s supposed to be some non-random hand smoothing going on MTGA.
  - baoluofu 3y ago
    My understanding is that at the start of a game, the system shuffles and draws three hands for you, and then selects one of them to be your actual starting hand. I don't know what heuristics it uses for which of the three to select, but typically in real life you would be hoping for three lands as a baseline, ideally that can tap for the colours of the spells in your hand as well. I believe this only applies in best of 1 matches, but not best of three matches. Unfortunately I don't have a credible source for this.
  - Karliss 3y ago
    Does MTGA not have any kind of Mulligan mechanics that would solve the initial bad hand?
    - Ensorceled 3y ago
Bluecobra 3y ago
My first real foray into Linux was inspecting network traffic with a program called ShowEQ for EverQuest. At the time, the traffic was unencrypted and had lots of juicy info in it. I used a hub to replicate traffic to my Linux box, and it would draw a live map of the zone and showed where the mobs, NPCS, and users were. It even showed what loot the mobs had on them so you could cherry pick certain ones. The beauty of this was that it was passive and impossible to detect. Eventually SOE wised up and started to encrypt the traffic.
- acters 3y ago
  The data has to be decrypted and read, so eventually you reverse engineer the client and figure out how to decrypt on the fly, then they wise up and introduce key based signing, which you eventually try to steal from the client and breaking the encryption again, then anti cheat is implemented... thus, the cat and mouse game is born, lol
  - Cpoll 3y ago
    It would also help to not send the high-value information to the client until required. Especially loot drops!
    - Workaccount2 3y ago
      But then you have to pay for more server side compute! Think of the profit margins!
      - bcrosby95 3y ago
        Sending loot on NPCs to every client costs more, not less. The reason why they probably did it is because NPCs actually used the items. When the froglok King loaded his two handed sword, he was actually using it. And when he didn't load it, he wasn't.
        deleted 3y ago
        [deleted]
no_time 3y ago
How hard would it be to write a server emulator that facilitates LAN matches with all cards unlocked? I have no interest in interacting with a glorified skinnerbox.
- RALaBarge 3y ago
  There was an app called Apprentice that was popular around 1996, and that is how we would lay MT:G via IRC. It was a generic tabletop simulator and you create or import he cards. https://www.apprentice.nu/ https://www.apprentice.nu/
- frameset 3y ago
  The project you want is http://xmage.today/ http://xmage.today/ All cards available, and full rules engine.
  - no_time 3y ago
    This is what I was looking for, thanks. Gonna give it a spin with friends.
- bodangly 3y ago
  You can just use Cockatrice for that. Sure it’s not as pretty or as easy, but it supports every card since you pretty much are playing paper magic and it’s not trying to be the referee.
  - _cenw 3y ago
    I think a lot of people explicitly do not want to bother with playing essentially paper magic, because it requires quite a bit more concentration if your board state is complicated to not miss any triggers or phase change too far accidentally.
    - bodangly 3y ago
      Understandable. I do think knowing how to play paper magic leads to a better understanding of the game but being a spike isn’t everyone’s goal.
JimWestergren 3y ago
On a related note, I have a blast playing old school magic 93/94 with my son. Of course using physical cards. We travel to Madrid each year to participate in the world championship of 7pts Singleton. This summer my son placed #9 which I am very proud of. 7pts Singleton is such a wonderful way to play the game with diverse affordable deck-building and balanced gameplay ( https://7pts-singleton.com https://7pts-singleton.com )
- indigo945 3y ago
  I wouldn't call a format where Black Lotus, Ancestral Recall and the Moxen are legal "affordable" - even though you can't play all of them in 7pts Singleton, even any single one of them costs thousands (or tens of thousands) of dollars. However, I'm glad you and your son enjoy the game, and congratulations on his placement.
  - JimWestergren 3y ago
    Yes, I agree. And we don't own them. I find it a very stimulating intellectual exercise to construct a deck without those cards and still perform great. Those powerful cards have several points and only 7 points total are allowed in your deck. For example I currently choose to play Sol Ring instead of 2 of the moxes.
  - JTon 3y ago
    You can get professionally printed proxies [1]. I've been told there's often a "don't ask, don't tell" policy around many unofficial mtg tournaments regarding proxies. It obviously upsets some people, but others see it as requirement for new players to enter legacy format (and keep it alive). [1] https://old.reddit.com/r/bootlegmtg/wiki/index https://old.reddit.com/r/bootlegmtg/wiki/index
    - JimWestergren 3y ago
      In the old school community: counterfeits absolutely not ok. Proxies normally ok except in some tournaments.

504 points by danielwmayer 3y ago

This is buried but fascinating: magic the gathering is turing complete, probably even more complicated than simply uncomputable , and possibly the most complicated major real world game https://arxiv.org/abs/1904.09828 https://arxiv.org/abs/1904.09828

onetimeuse92304 3y ago

Pure client side game logic... I once developed a small game. Sometimes, for responsiveness, you need to implement game logic on the client. But nothing says you can't redo the logic on the server and that's what I did. It can be hard on a real time game like FPS or RTS, but there simply is no excuse for a card game. I think for a card game like this you really want to send no more information to the client than a real player would see. So for example, rather than send the cards that the opponent has in hand, just send the number of cards that he has -- no more and no less than what you would see in a real game situation. It goes without saying that any actions sent to the server are only speaking for you and not your opponent. So no, you should not be able to declare forfeit for your opponent. You should only be able to say "forfeit!" which the server interprets as your forfeit because you are the only player you have power over.

mkonecny 3y ago
The author explicitly mentions this is how the game is implemented in the first 1/3 of the article
lewisedc 3y ago
I'm pretty sure the article declares the game was programmed in exactly the way you are suggesting it should be, where you only get the information required at the time it's needed, and you only send actions for yourself. The exploit was that one was able to set up a second client and connect to the currently ongoing game but in the opponents seat, once this was done they could sene actions as the opponent including the forfeit action.
Ensorceled 3y ago
> It can be hard on a real time game like FPS or RTS, but there simply is no excuse for a card game. As the article clearly states, the game play is entirely server side. The author exploited a problem in the authorization and game connection code, not any client side game logic. > It goes without saying that any actions sent to the server are only speaking for you and not your opponent. So no, you should not be able to declare forfeit for your opponent. You should only be able to say "forfeit!" which the server interprets as your forfeit because you are the only player you have power over. You are simply repeating how exploit that the author found works.
PawgerZ 3y ago
Reading the post explains the post.

Sweepi 3y ago

"I was totally surprised by this, because it means that a (mostly) fully-functioning bot capable of playing arbitrary games of Magic: The Gathering has a small enough footprint to run locally on your machine" I dont get that. Maybe I am missing something. Lets say, the MTG AI was so intensive to run that it would be unreasonable to run on the customer's machine - then I wouldn't run it on the server either, since it would be quite expensive (and bot games in card games are usually not pay per play). Also, servers are not magic - most of them run on the same x86 CPUs as the local machine, with a lower clockspeed than their desktop counter parts (but higher than (most) notebooks). Therefore, the only way to archive a lower Bot turn timer compared to running locally would be to use significantly more cores than the customer (usually 4-8, hence 8-16 allocated cores per player?!). Sounds like a nightmare, especially during peak concurrent player hours/days! If the CPU Player does not support multi-core, running locally should be faster in any case.

Ensorceled 3y ago
>> "I was totally surprised by this, because it means that a (mostly) fully-functioning bot capable of playing arbitrary games of Magic: The Gathering has a small enough footprint to run locally on your machine" > I dont get that. Maybe I am missing something. Lets say, the MTG AI was so intensive to run that it would be unreasonable to run on the customer's machine - then I wouldn't run it on the server either [...] They said "footprint", not "processing power". The bot's rules engine is small enough to run in the memory footprint on older iPhone or Android devices, a server could have a lot of memory dedicated to holding a state machine or rules engine and still use very little processing power to execute the engine for any particular request.
lima 3y ago
MTG is a very complicated game with a complex ruleset.
- apetresc 3y ago
  His point wasn't that an MTG bot should be easy to run, his point was that it shouldn't be any easier/cheaper to run server-side than client-side. But to address your point, while that is true, Sparky itself plays with very basic decks, and plays even those very poorly. The goal of Sparky is to introduce players to the rules, not to be a competitive MtG agent; playing badly is intended. I wouldn't be surprised if Sparky's code is actually just a bunch of very simple heuristics (maximize your mana utilization this turn, attack with any creature that can trade evenly or better, etc).

partomniscient 3y ago

The thing that weirded me the most in the article out was seeing the 'goto IL_1894' statements in C# code. It brought back memories of error handling in VB6, and was rather unpleasant. I presume this is being done for performance reasons?

neonsunset 3y ago
This is simply how C# decompiled from IL looks like - sometimes you can turn IL-level gotos back into control flow idioms and sometimes not.

deleted 3y ago

[deleted]

erfgh 3y ago

MTG is not very interesting when actually playing it. Most of the game is building your deck. Thereafter the deck mostly plays by itself.

mgdev 3y ago
Building deck = programming Playing = executing
alfons_foobar 3y ago
There are drafts/sealed, you know...

wbecher 3y ago

well... WOTC is a small indie game company

dbttdft 3y ago

[dead]

araes 3y ago

The TLDR is a little too short. - Decompile C# for Sparky bot [a], rewrite Sparky to be a substitute online opponent, connect Sparky vs you online as if you're connecting a human in a match, have Sparky auto-concede and jack your win rate. [a] Note I thought was interesting was: "C# is also really nice because it utilizes metadata tokens to associate elements of the compiled code with their human-readable names, which are still stored in the compiled .NET assembly. That means I can see all the function, variable, and class names that the developers wrote when they wrote their code." Which means its super easy to reverse engineer.

chupasaurus 3y ago

In League of Legends there was a division-by-zero bug with a certain champion and item which caused server to kick all players and then crash. Because the exploiter was being kicked last, their team gets the win while opponents get Loss Prevented because the game doesn't have a normal result.

MaxikCZ 3y ago
If the enemy doesnt get loss because game doesnt have normal result, winning team should not get win aswell...
- chupasaurus 3y ago
  IIRC it was added to the game because of serial leavers (and cheaters, which is funny with this exploit) and then sometime later applied to deal with server instability issues.
BlorpyHuman 3y ago
[flagged]
deleted 3y ago
[deleted]

squeaky-clean 3y ago

That's very fun. This is a "simple" enough exploit that I sent it to my MTG group chat, I bet they can understand it without needing to understand any programming jargon beyond client/server. I'm simultaneously surprised something this simple worked, and also not surprised at all. He does make a good point, this is an effective way to provide a practice bot and not need to make many server side modifications. I understand why they did it this way. The problem is they didn't make any server side modifications haha. Edit: so far 3 of them have given me a lol or laugh emoji. This is excellent writing.

danielwmayer 3y ago
Thank you!
adw 3y ago
It’s shown up in one of the bigger Magic-podcast Discords too. You nailed the writing on this. And “always validate your inputs”!

chrisweekly 3y ago

Kudos for a very well-written and educational post!

w-ll 3y ago

Lol, i recently got into MTG again with MTGA. I did a quick decompile as its a Unity game and not il2cpp (not that it would have protected it that much) but I found some fun stuff too. Keys for their epic launcher build, some undocumented apis. I never wanted to use it to cheat, i really just wish there was a battle log. What matches I won, what I lost, view the battlefied of a finished game, etc... Gonna check this out, but hopefuly its patched quick.

tayo42 3y ago
I'm pretty sure this exists. I think it's player log. There are a bunch of apps that do tracking that use it iirc
- blargpls 3y ago
  There is mtgatool, an open source app to read the logs and generate a history of played games and some statistics: https://github.com/mtgatool/mtgatool-desktop https://github.com/mtgatool/mtgatool-desktop
Namahanna 3y ago
https://mtgaassistant.net/ https://mtgaassistant.net/ is the most common one I know of for collecting your play data.
danielwmayer 3y ago
This vulnerability was patched before I wrote the post - I disclosed it to MTG. In terms of viewing your history, you should check out https://untapped.gg/en https://untapped.gg/en. I have talked to them a bit and they essentially do what you want. They take most of their info from MTG's debug log, which you can find in MTGA's application directory, so you could also make your own tracker as well if you want. They talk about it on their site: https://help.hearthsim.net/en/articles/3620440-how-do-i-supply-my-untapped-gg-companion-or-mtga-log-file https://help.hearthsim.net/en/articles/3620440-how-do-i-supp...
- 59nadir 3y ago

ProjectArcturis 3y ago

I love the accessible yet insightful level of detail in this post. One thing I don't understand is, in the case where you connect your bot during a real match, 1) why does the game allow someone to join mid-match, and 2) when the bot resigns, why does that count as your opponent resigning? If it's creating a 3-player game, Player 3 conceding shouldn't also make Player 2 concede.

virgildotcodes 3y ago
1) I'm guessing this is how they handle people reconnecting after a disconnection. You terminate the old connection? 2) The bot replaces player 2, then submits a resignation. The server registers it as player 2 resigning.
- ProjectArcturis 3y ago
  Ah, makes sense. I guess they just assume that any client who is requesting to sit in that seat is authorized to.
  - Ensorceled 3y ago
    Yeah, the seat is the problem. There are a LOT of security systems that depend on assuming the holder of a large random string, like a guid, is the proper holder of that string so it's not necessarily a bad thing for the match. They should have made the seat index random as well though they are probably now just checking credentials.
  - knallfrosch 3y ago
    Looks to me like they only verified match ids, not the seats at all.
- Ensorceled 3y ago
  Yes, I had my desktop version of MTGA hang and when I connected to the match with my iPhone it immediately disconnected the desktop.
3y ago

r1ch 3y ago

This takes me back to the Diablo 2 days when you could connect an open server character (LAN) onto the official bnet (internet) servers by reusing the same connection packets. Since open server data was all saved locally, you could create all kinds of items that aren't supposed to exist and the official server would still accept them.

althea_tx 3y ago

Great post. Thank you for highlighting that hilarious code comment.

hfuaiobfa 3y ago

Congratulations again for the top story, Daniel! I was hacking on MTGA since you posted this article and spoke a little about that with you on GitHub [0]. For anyone interested, I'm _inactively_ working on an unofficial client of MTGA which does hardly anything meaningful for now. The vision is to provide some automation for playing ranked games and stronger bot opponents. Sadly I was distracted lately away from the project and am still puzzled how to make a good UI to see things clearly. I can't even estimate when it will be barely useful. Beside that, I'm still very interested in any game hacking story of Daniel and anyone else! Please tell me more about how to spot such bugs, how not to worry being banned after such hacking, how to `disclosing the bug to them` like @aethros commented, how to structure an unofficial card game client, and other stories. Thank you! [0] https://github.com/MayerDaniel/mayerdaniel.github.io/issues/1 https://github.com/MayerDaniel/mayerdaniel.github.io/issues/...

extraduder_ire 3y ago

> I would have thought that a game as complex as MTG would require a lot of overhead in terms of creating an AI opponent. But nope! You can actually check out all of the logic for Sparky, including a few places in the debug UI where WOTC developers reached a corner case that they felt was not worth implementing. I don't blame them - MTG is a beast of a game to try to have full coverage for! This is a huge understatement, since the game is nearly (no infinite loops) Turing complete, and people have a lot of fun with that. I assume there's a lot of work already done on AI strategy for it though. The post title should probably have a "Show HN:" on it too, since you're posting it yourself.

dmurray 3y ago
"The game can be used to encode a Turing machine" is not at all the same as "it is difficult to write a program that can play a legal action in every situation". It's the latter that seems to be difficult for the bot authors.
- jprafael 3y ago
  > "it is difficult to write a program that can play a legal action in every situation" This is trivial (just forfeit). The hard part is figuring out the best possible action to select from. MTG is particularly hard at this because: * Some actions are only allowed in certain conditions (e.g. in response to, in a specific phase, etc) * Actions vary significantly not only in their effects but also in their inputs (some require targeting a creature, a player, an opponent, a card in hand, a card in exile, a name of a card that could exist). Some have a varying list of inputs (target many creatures). This variance makes it hard to encode the action space. * The state space is huge. It is not only determined by the cards in play, but is also affected by the meta-game (to play optimally players have to play in a specific way to avoid getting countered by a card that could be in play by the opponent, because that card is legal to play and is commonly used by decks that look like what the opponent is playing). * Technically the state space is also infinite because you can create infinite loops that keep creating more and more triggers/creatures/etc.
  - 3y ago

BillyTheMage 3y ago

Wish we could hack the card-shuffler for MTGA. I can't remember the last time I had a match where at least one of us didn't have either no land or nothing but land.

minimaxir 3y ago
This goes all the way back to the original Magic the Gathering: Online in 2001. tl;dr it's actually random unlike real shuffling: https://forum.nogoblinsallowed.com/viewtopic.php?f=15&t=11845 https://forum.nogoblinsallowed.com/viewtopic.php?f=15&t=1184...
- ugexe 3y ago
  MTGO does not use the same shuffler as MTGA
mproud 3y ago
There’s supposed to be some non-random hand smoothing going on MTGA.
- baoluofu 3y ago
  My understanding is that at the start of a game, the system shuffles and draws three hands for you, and then selects one of them to be your actual starting hand. I don't know what heuristics it uses for which of the three to select, but typically in real life you would be hoping for three lands as a baseline, ideally that can tap for the colours of the spells in your hand as well. I believe this only applies in best of 1 matches, but not best of three matches. Unfortunately I don't have a credible source for this.
- Karliss 3y ago
  Does MTGA not have any kind of Mulligan mechanics that would solve the initial bad hand?
  - Ensorceled 3y ago

Bluecobra 3y ago

My first real foray into Linux was inspecting network traffic with a program called ShowEQ for EverQuest. At the time, the traffic was unencrypted and had lots of juicy info in it. I used a hub to replicate traffic to my Linux box, and it would draw a live map of the zone and showed where the mobs, NPCS, and users were. It even showed what loot the mobs had on them so you could cherry pick certain ones. The beauty of this was that it was passive and impossible to detect. Eventually SOE wised up and started to encrypt the traffic.

acters 3y ago
The data has to be decrypted and read, so eventually you reverse engineer the client and figure out how to decrypt on the fly, then they wise up and introduce key based signing, which you eventually try to steal from the client and breaking the encryption again, then anti cheat is implemented... thus, the cat and mouse game is born, lol
- Cpoll 3y ago
  It would also help to not send the high-value information to the client until required. Especially loot drops!
  - Workaccount2 3y ago
    But then you have to pay for more server side compute! Think of the profit margins!
    - bcrosby95 3y ago
      Sending loot on NPCs to every client costs more, not less. The reason why they probably did it is because NPCs actually used the items. When the froglok King loaded his two handed sword, he was actually using it. And when he didn't load it, he wasn't.
      - deleted 3y ago
        [deleted]

no_time 3y ago

How hard would it be to write a server emulator that facilitates LAN matches with all cards unlocked? I have no interest in interacting with a glorified skinnerbox.

RALaBarge 3y ago
There was an app called Apprentice that was popular around 1996, and that is how we would lay MT:G via IRC. It was a generic tabletop simulator and you create or import he cards. https://www.apprentice.nu/ https://www.apprentice.nu/
frameset 3y ago
The project you want is http://xmage.today/ http://xmage.today/ All cards available, and full rules engine.
- no_time 3y ago
  This is what I was looking for, thanks. Gonna give it a spin with friends.
bodangly 3y ago
You can just use Cockatrice for that. Sure it’s not as pretty or as easy, but it supports every card since you pretty much are playing paper magic and it’s not trying to be the referee.
- _cenw 3y ago
  I think a lot of people explicitly do not want to bother with playing essentially paper magic, because it requires quite a bit more concentration if your board state is complicated to not miss any triggers or phase change too far accidentally.
  - bodangly 3y ago
    Understandable. I do think knowing how to play paper magic leads to a better understanding of the game but being a spike isn’t everyone’s goal.

JimWestergren 3y ago

On a related note, I have a blast playing old school magic 93/94 with my son. Of course using physical cards. We travel to Madrid each year to participate in the world championship of 7pts Singleton. This summer my son placed #9 which I am very proud of. 7pts Singleton is such a wonderful way to play the game with diverse affordable deck-building and balanced gameplay ( https://7pts-singleton.com https://7pts-singleton.com )

indigo945 3y ago
I wouldn't call a format where Black Lotus, Ancestral Recall and the Moxen are legal "affordable" - even though you can't play all of them in 7pts Singleton, even any single one of them costs thousands (or tens of thousands) of dollars. However, I'm glad you and your son enjoy the game, and congratulations on his placement.
- JimWestergren 3y ago
  Yes, I agree. And we don't own them. I find it a very stimulating intellectual exercise to construct a deck without those cards and still perform great. Those powerful cards have several points and only 7 points total are allowed in your deck. For example I currently choose to play Sol Ring instead of 2 of the moxes.
- JTon 3y ago
  You can get professionally printed proxies [1]. I've been told there's often a "don't ask, don't tell" policy around many unofficial mtg tournaments regarding proxies. It obviously upsets some people, but others see it as requirement for new players to enter legacy format (and keep it alive). [1] https://old.reddit.com/r/bootlegmtg/wiki/index https://old.reddit.com/r/bootlegmtg/wiki/index
  - JimWestergren 3y ago
    In the old school community: counterfeits absolutely not ok. Proxies normally ok except in some tournaments.