oscan.net

Santas Blizzard Blitz

Tue, 13 Dec 2011 12:42:05 GMT

So the game I showed in my last blog post has now been released; Santas Blizzard Blitz. Unfortunately the game did not attract enough attention to get itself a sponsorship (I'm not going to pontificate on the reasons, but I know it has a few flaws), so I am once again going to release the game myself with ads. If it were a non-seasonal game I'd just let it sit and wait for something to come through, but for a Christmas themed game there is only a few weeks in the year where it would get any attention. Although the game did get one bid of $100, I felt I could easily make that on my own, especially since I have outstanding revenues from previous games that are currently below their payout thresholds.

I'm not expecting great things from going this way, especially since I am using a few different ad networks to see how they perform, which will split any earnings (and risk not even reaching those payout thresholds). But hopefully MindJolt will once again come to the rescue; they will be publishing the game on Dec 22nd. Although from anecdotal evidence it seems their revenue from their ads is not what is once was, it will probably still make up the bulk of any plays/earnings. I'm also implementing their micro-payments system, so it will be interesting to see how that goes.

And with that, there goes my last colour-matching puzzle game. It's now time to move on to something a bit more complicated.

Christmas games and Fog of War

Tue, 11 Oct 2011 4:43:18 GMT

It's been a while since I've finished and published a game, a bad habit to get in to, so I decided I should make something before I completely forget how it is all done. In order to give myself a relatively close deadline I am making a christmas game (to get a christmas themed game sponsored you need to ideally have it done by at least early November.)

I'm dusting off an old redesign of Blockdown I had been tinkering with early in the year, keeping just and main matching mechanism but losing the block locking (so it can't really be considered 'Blockdown' anymore). One of the main problems I found with Blockdown was that when you made the 2x2 match the replacement block spawned directly in place rather than there being any cascading. This had been a concious decision at the time for... some reason, but it ultimately led to the game being far too static and so not so interesting.

Now I have altered it so that when you make a match the pieces from above cascade down into the empty spaces, and then the empty spaces left over from the dropping pieces are filled in from the sides. The new spawning pieces then come in from the sides.

Also, I've slightly changed the matching so that not only are the 2x2-on-the-corners base match pieces removed, but also any adjacent pieces of the same type that are touching (and in turn any matching pieces adjacent to those pieces). This should make the board more dynamic and hopefully more enjoyable.

The timer now takes the form of falling snow that builds up in columns on top of the grid. When pieces fall due to a match, they take the snow above with them. If any of the snow piles reaches the top of the screen, that's game over. This is kind of like the Ice Storm mode in Bejeweled 3, but I swear I had this idea before I had seen that! Really!

I am also doing all the art for this myself (I had been determined that whatever my next game was I'd get somebody else - somebody competent! - to do the art).

I think it is turning out okay for the most part; I particularly like my santa! I am drawing the outlines of everything in AutoCAD of all things (use what you've got and what you know!) and then bringing them over to PSP.

In other news, prior to all of this I had been working on a custom game engine, focusing mainly on Line of Sight and Fog of War. Maaaybe something will eventually come of it...

Embedding shadow and collision vectors in to a tileset spritesheet

Numbers, numbers, numbers: Trinhex and Blockdown

Sat, 26 Mar 2011 10:21:12 GMT

So it's been a while since I posted anything about Trinhex and Blockdown, the two flash games I made last year, so it is probably time for an update on how they have performed.

So when I had last posted about Trinhex, back in June, it had just been released after about four months of being available for sponsorship. The game didn't appear to attract much of any interest from sponsors on Flash Game License in the time it was up there; although it did get its fair share of views, it didn't get any bids. This could be as much a reflection on the genre than the game, with colour-matching games not being on the top of many people wish lists. The sponsor I did get was via posting the game over on mochi.

That Primary license went for $400. This was initially for an ad-free release, but a short while afterwards I was allowed to release it with ads. To date the ad revenue from mochi on Trinhex is $22.56, form 51k ad impressions (but of course I'm not likely to see the mochi money for a looong time, as they only pay out once you reach a minimum of $100 with them, and my current total to date is only $35.94, with a recent average of $0.03/day from only double figure impressions. It will take a few new games for them to ever pay out).

The game also sold one site-lock Secondary license, which went for $120.

It also went up on Mindjolt in November, which required adding in their new advertisement system. This put the game up on a number of social networking sites, but the only one of any interest is of course Facebook. So far that has generated over $445, of which $387 was paid out. Mindjolt also only pay out in minimum $100 intervals, so I'll need to make another $42 before I get paid again (and I am averaging about $0.12 to $0.20 a day recently).
Most of this success was from the game being on the main Mindjolt app page, but they also eventually released it as a standalone app on Facebook. This was apparently supposed to have generated a good bit of new traffic, as other games have done very well with it, but I haven't noticed any difference. So again I am unlikely to see the rest of that money unless I submit a new game, or a flood of new traffic miraculously comes in.

It terms of views and plays, Trinhex has totalled 607k views and 707k plays. Of those 388k and 484k, respectively, were from Mindjolt. There is a slight discrepancy in those numbers as Mindjolts own metrics show 532k gameplays, which is a 9% difference from those shown by Playtomic, but a bit a difference is to be expected as Playtomic is an external service and you can't be guaranteed a connection. Incidentally, Mindjolt also show 431k ad impressions, which makes for an eCPM of $1.03, not bad at all!

The last (and first) time I talked about Blockdown it was still available for sponsorship on FGL. Since the game is similar to Trinhex in many respects it suffered the same fate, if not worse (this will be a bit of a theme), on that site. It was up on FGL for longer, received fewer views and did not end up with any serious bids and ultimately went without a Primary sponsorship deal. In the end I got tired of waiting and decided to release the game myself with ads to try and earn at least something.

But that wasn't entirely the reason I decided stop waiting and release. I had an offer from Mindjolt for a site-lock version of the game. This was a deal for $400! But in order to take that the game had to be released. I waited a small amount of time to see if there were any last minute bids, using the Last-Call feature on FGL to get some last minute attention, but none appeared.

This deal meant that Mindjolt would get all ad revenue from the game, whereas if you go via the normal submission system there is a 50/50 split between Mindjolt and developer. This means they would be getting about $2 eCPM and so they needed at least 200k impressions to break even. While I don't have access to the same internal gameplay/impression metrics that I do for Trinhex, I do have Playtomic to tell me that Blockdown has done at least 342k views and 326k plays on Mindjolt alone. So they at the very least have made their money back.

The interesting thing to note about those numbers, which are also reflected in the total numbers, is that the number of plays is less than the number of views. This is a bit odd and indicates that something isn't quite right.
The total numbers are 454k views and 395k plays; meaning that in the non-mindjolt numbers there is a wider disparity.

There were certainly people for who their Flash player wasn't up to date enough and so they could never have played the game in the first place, but still would have registered a view. But that only amounted to about two thousand views.

It could be that people did play but quit very early and so the 'play' never registered (I would have to check the specifics of the version of the API I was using at the time to see if that was a possibility). The 'bounce' rate, how many people quit within the first 30 seconds of a game, was higher for Blockdown, at 22.4%, compared to Trinhex at 14.5%.

It may be that people took one look at the main screen and decided not to play at all.

Or... there was a bug, which prevented people playing at all. It would be unfortunate if it was this.

Blockdown went up on Mindjolt exactly one week before Trinhex, but as you can see did not do as well. It also has a lower overall average play time at 5:30, compared to 12:30 for Trinhex. I attribute this to the fact that as a continuous game (as opposed to Trinhexs 5 matches per level) the game board was too static.

I had made a conscious decision to not have cascading pieces after a match, ala Bejewled, instead just respawning pieces where the old pieces were matched. Another limiting aspect I feel was that you only ever matched four pieces. This ended up making the game too... well, boring.

I have these rectified in a prototype for a different game that uses the same basic matching concept, which I think is much more interesting. Whether or not that will ever see the light of day is if I can decided on a graphical theme that will work.

As far as non-Mindjolt money goes, for ad revenue from the 'primary' release it has earned a whopping $9.35, from all of 35k impressions. So even with a better paying ad system than mochi, 'self sponsoring' a colour matching puzzle game just isn't worth it unless you have your own games portal to pimp, or you have a nice site-lock deal ready to take!

The game also won $100 dollars from FGLs mobile Flash for Android competition. It was really more of a 'taking part' prize than a real 'prize'.

So... all in all the two games have totalled approximately $1,510, of which I've been paid $1,407. After commissions, transaction fees, and various exchange rates at different times that comes to €945 into my bank account.

I think I can be reasonably happy with that and with over 1.1 millions combined gameplays for the two games. But of course there is much room for improvement, and I hopefully those improvement will be made!

IGSDublin: Save The Zombies!

Wed, 16 Mar 2011 2:35:59 GMT

Last month I attended the first of what is hoped to be a series of monthly indie game developer events in Dublin called Indie Games Space, organised by gamedevelopers.ie and held in Film Base in Temple Bar. It is a chance for independent developers to get together, show off their work, listen to a talk and work on a monthly design challenge (and get free t-shirts from the guys at havok! Thanks!).

Last month, Paul Conway showed and talked about the development process of his great Dragon Age addon Craggy Island.
For the challenge you could work in groups or solo (and being the unsocial hermit that I am, I went solo, naturally) to design and implement a game based on two themes. For this first challenge the themes were disease pandemic and failure. An extra 'unofficial' condition was then tagged on... "no zombies"! Blatant discrimination!

Seeing as how there are already pandemic games dealing with the global scale, I started thinking on a more local scale, but still involving infection vectors in populations (yeah, so not really pandemic at all).
I had originally been thinking of having a virus trying to spread throughout a group, but being combated by a genetic 'cure' that was also spreading through the population. I was going along the lines of having single gene recessive/dominant phenotype resistance to the virus, so that there could be simple varying degrees of protection. This ended up getting a bit too complicated, including the need for a reproducing population and that would have just gotten messy, in more ways than one. It was also becoming more of a simulation and less of a game.

So I ended up slightly reworking it so that it became VvV... Virus verses Virus. It is a two-player game where each player has to create a virus that infects and kills the fewest amount of people. The virus with the lowest score wins (the failure theme).

So I made it...

Play Save the Zombies! (Flash)

Ah... yeah, zombies.
I only used them as I was going to use the isometric engine I had been making last year (and promptly ignored) and the only avatar spritesheets I had to hand were Brookes Metaplace zombies, so I decided to use them. Otherwise it would have had to be squirrels!

Players change a simple set of sliders to alter the attributes of the viruses, which effect how they spread and survive.

Range: is simply how close another zombie has to be before it possibly be infected by a contagious zombie.
Incubation: determines how soon a zombie becomes contagious after being infected (the smaller the bar the sooner)
Infectiousness: is how aggressively a virus will try to infect
Lethality: is how easily the virus will kill (this also plays a role with incubation time)
Durability: is how well the virus can survive in the host zombie

Making one attribute less effective made others more effective.

Each zombie gets both a random generic health and immunity values to help fight off the viruses, so there are differences from one zombie to the next on how they will cope.

Another degree of randomness is the fact that zombies are constantly wandering around the map.

"all we wanna do is infect your brains"

Your initially infected zombie could walk into a corner and never spread its virus before it manages to get rid of it itself.
The game starts by randomly infecting one zombie for each virus. I probably should have allowed players to examine the initial state of the map and then select their preferred zombie to infect.

Each infection scores one point, each death three. Each game takes a couple of minutes, although sometimes it can drag on when those damn brain eaters refuse to just die; the game ends when their are either no zombies left 'alive' or there are no current infections. Otherwise you can just end it prematurely.

Infected and contagious zombies... poor little things

So there it is. It's not at all balanced and there are probably some show-stopping bugs in there somewhere, but it works for the most part for me. Any feedback would be welcome. Comment below!

Play Save the Zombies! (Flash)

I should probably get back to working on something that might make some money now. Speaking of which, I must post about how Trinhex and Blockdown have done since my last post.

Game Dev progress report: Progress!

Sun, 13 Jun 2010 4:00:47 GMT

Trinhex is finally out in the wild!

My thanks to Lisandro from 7lay.net for being willing to sponsor the game, and for being so patient during the whole bidding process, which I allowed go for... a while :).

Starting into its fifth day of being published the game has racked up almost 20k plays so far on about 130 sites. On Newgrounds it managed to get a rating of 3.43/5 with about 1,400 plays before falling into the black hole of obscurity. On Kongregate it scored about 2.8 after 965 plays to date, with the last few hundred plays thanks to a post from Raph.

Game 'number 3', that I had been prototyping at the time of the last post and that is now known as Blockdown (FGL link), has been completed for a while and is waiting to see if it can pick up a potential sponsor. We seem to be in a bit of an early summer lull for the flash sponsorship market, so it may have to wait a while longer. Although my games appear to be in a constant lull in terms of attracting sponsor interest. :)

In the meantime, I've been slowly working away on an isometric engine for a possible Tower Defense-esque game...

Game Dev progress report: Lacking progress...

Thu, 04 Mar 2010 7:31:11 GMT

It's been just over six weeks since I released my first attempt at monetising a complete flash game, Pompetaire, out into the wild. This game just had a pre-loader ad attached (no attempts at finding sponsorship were made) and was uploaded to Kongregate (no ads), Newgrounds and added to Mochi's distribution list.

To date the game has earned a grand total of.... wait for it..... $2.37!
$0.85 of that comes from Kongregate from 666 plays (35% of a total revenue of $2.42) all of which were mostly from the first week, with the rest, $1.52, coming from MochiAds from just under five thousand ad impressions. Over a third of the mochi earnings came from a single site, onlinespiele24.org, which only picked up the game over three weeks after the game was first released.

Suffice to say the game never "gained traction", to borrow Metaplace's phrase, with reviews being decidedly average, hovering just above the 50% mark.

So all in all a failure!

But with every failure there are lessons to be learnt, some of which I had in mind when putting together my next game Trinhex.

Spot the reused assets!

This is a colour matching game based upon Raph Koster's original game Wheelwright

This time I decided to take the sponsorship/licensing route by using FlashGameLicense.com, which can provide the potential of a few thousand US dollars per game, assuming you can manage to entice a sponsor to put in a bid. So far the game has been available to potential sponsors for just over two weeks now with no solid offers, but it is still considered too early to say how it will do. It may take up to a month or two before the right sponsor comes along.

In the mean time I am working away on game number 3...

ThatFallingBlockGame source

Mon, 08 Feb 2010 4:49:55 GMT

I've posted the complete source to my Metaplace tetris clone, That Falling Block Game, under the games section.

Pompetaire: Game finished and published!

Tue, 19 Jan 2010 5:24:28 GMT

Okay, so it was a little bit over two weeks...

The game is now "finished" and has been sent out to fend for itself in the thunderdome that is the net. I hope it doesn't get too savagely beaten!

It is currently awaiting approval to be added to Mochis Partner Publisher list and is also up on Kongregate. The relative success of the game on Kongregate will depend mainly on the rating it gets from the community there, so feel free to sign up and give it a 5-star rating! And then get everyone you know to do the same. ;-)

Flash Game: Pompetaire... almost there

Thu, 14 Jan 2010 11:19:46 GMT

I'm now over halfway through the second week of my self-imposed two week time limit for creating a flash game. I'm mainly in polishing mode now, making everything look pretty. Apart from the ads, which I have yet to put in, it is probably 90% there.

I've also decided on a name. Pompetaire! I guess I probably have to explain that...
Since the game is basically Spider Solitaire, I decided I'd call it something-taire; it was just a matter of figuring out what the something should be. As things in the game are mostly grouped into lots of five, I thought perhaps Pentaire or Quintaire. Although Pentaire doesn't exist, there is a Pentair, which is a water services equipment supplier, so that was a bit too close. Quintaire appears to be a surname (or sometimes a first name).

I ended up going a bit more obscure and decided to use the oscan word for five, which is pompe, so I end up with Pompetaire. As far as google is concerned this word simply doesn't exist. At all. This has the added benefit of allowing me to be able to track the spread of the game by searching for any mentions of the word used on the net (not that I have high hopes that it will spread far and wide).

So here we have the almost there version...

[edit]
Link to final version
[/edit]

I still have a few questions for myself on the gameplay - as to whether it is perhaps a bit too easy - so again I would greatly appreciate feedback from play experiences at various levels!

In this version the 'strict' and 'non-strict' rules are merged; where a 'strict' move, as indicated by the green placement guide, only costs one point per move, and a 'non-strict' move, as indicated by the red placement guide, costs 5 points per move. I am toying with the idea that I should only allow up to 5 non-strict moves per game, so it would be up to the player to decide when best to use those moves. All assuming the current version doesn't provide enough challenge.

Thanks for your help!

Help Play test a Flash game!

Wed, 06 Jan 2010 6:52:50 GMT

On Monday I started my effort to complete a flash game in two weeks, making a simple Spider-Solitaire-as-a-colour-matching-game... game.
For this project, the intent is not necessarily to make the most engaging play experience ever, but simply to just get a finished, polished game posted on a game portal site. That being said, I'd still like for the game to be somewhat fun to play, so I'd like to get feedback from some play testing, if you would be so kind to give it a shot please?

Below is a working prototype (meaning it won't look like much, as it is all place-holder graphics, but the gameplay is mostly all there) that I've put together in the two and a half days since getting started.

[edit: prototype removed. see post above]
How to play:

To win a game you need to clear the board of all pieces.
To clear pieces you need to stack shapes of the same colour in increasing 'size' from top to bottom.
Shape 'sizes' in order, ranging from 1 to 5, are circle, oval, triangle, square and pentagon. So you want circles on the top of the stack, pentagons at the bottom.
(This will hopefully be more intuitive with final graphics)
You can place a shape on top of another shape of the next size up regardless of colour (e.g. triangle on a square, square on a pentagon).
If you disable the 'strict' setting, you can place a shape on top of any larger shape (e.g. circle on a square)
You can only move multiple shapes at the same time (moving one shape and everything above it) if all the shapes are of the same colour and in the correct order.
Not all of the pieces are on the board at the beginning. You need to choose when to 'deal' in these additional pieces, which will be added to the top of each column.
A column cannot go more than 12 pieces high. If a column is 12 high, it will block the next deal.
If you find yourself not able to make a move then you lost that game (no prompt as yet)

That's the basics of it. It's not too hard to understand once you go through it once.

There are three levels: easy with just one colour, medium with two, and hard with four (it starts on medium).
If you have some time to perhaps play through a few games of each, with and without the strict setting, I'd greatly appreciate it if you could give some feedback below. Was it challenging? Was it fun to play? Or only somewhat? Completely boring? I hate these games!

There are likely to be a few bugs floating about, so if you run into any if you could mention them below too would be a great help.

Thanks for your help!

[edit]
updated the graphics a bit to make it a bit easier on the colour blind.

Metaplace asset grabber

Mon, 28 Dec 2009 4:43:11 GMT

I've put together an asset grabber for Metaplace to make it easier for users to download scripts, images, sounds, tiles & maps (for each place) and initial tag stream from their various worlds. This is basically a mini client that connects to a world and parses the lists of assets that are normally sent to clients.

A few things to be aware of:

The username supplied is case-sensitive and must be exactly the same as displayed on your metaplace profile. e.g. Obo not obo.
You are required to provide your metaplace password. Just be aware this is not an official metaplace service! That said, your password will not be stored anywhere. Just be aware of any similar service that does as for your password.
Once you submit the form nothing will appear to happen other than the browser will appear to be connecting to oscan.net. This is the way it currently works, so just let it be! Once it has grabbed all the assets it will pack them into a Zip file and then give you a prompt to download it. Don't hit the submit button twice!
This process may take a while for large worlds, so BE PATIENT! If the browser looks like it is doing something then just let it work away.
Where possible use the "local only" option to only get 0:x assets if you don't need everything from the world.
If you get an error link "could not connect to game04.metaplace.com:5101" then try again later. Your login session tried to connect to a server and/or port my web host hasn't put on the white-list to allow connections.
If an asset could not be downloaded it should be listed in the error_log provided in the zip file.
While it works for me it very well might break, and there is not much time left to allow more testing! If something goes wrong leave a comment here or use the contact page and I'll try and track down the problem.

So here if the link...
http://oscan.net/metaplace/asset_grab/

I'll see about making it easier, more foolproof, to use in the next few days if needed.

[edit]

Fixed an issue with the content of downloaded scripts being a web-api error message like...

[S_ERROR]|110|web_api|You have exceeded the maximum of 50 requests per minute.

Too lazy to check if there was an actual error, so I just rate limited it to one script per second, or three seconds for every tenth script.

I also altered the 'Local Only' option so that you could set a specific worldscope, instead of just 0:x.

[edit 1st Jan]
For some reason access to the game servers got blocked again, so this wasn't working from around some time last night. Should be up and running again (apart from the bits that don't work :P).

Moving on (or back) to Flash

Sun, 27 Dec 2009 4:34:26 GMT

With the closing of Metaplace a lot of its users are now asking themselves "where to now?". Some are looking for another social hangout, others, like myself are thinking more about game development environments. There has been a lot of talk about Unity 3D, which I've been meaning to have a look at for a while, but first I think I'm going to try out Flash... again (although to be pedantic it'll be Flex).

After my 'success' of creating That Falling Block Game on Metaplace (okay, okay, I'll finally admit it... It's TETRIS!), and buoyed by the success stories of others, I thought I could try my hand at creating a real flash game rather than trying to contort a virtual world platform into one. So last summer, after finally figuring out you could create flash apps for free with the command line flex compiler (therefore avoiding the need to spend hundreds on the Flash development program) I started to make a flash game!

Adventures in Actionscript
The scripting language, ActionScript, had changed a bit since I had last played around with it, so I used this great tutorial for making games in flex to get myself up to speed (since AS is from the same family as JavaScript it wasn't too hard to get in to).

I had decided to try and make a Peggle like hit-the-targets-with-the-bouncing-ball game, just without gravity. That was probably my first mistake; wrangling with physics while trying to learn the ins and outs of a platform is probably not the best idea. My second, and most likely biggest, mistake was to write all that physics interaction myself, rather than use a 3rd party library. It seemed a somewhat reasonable decision; there was only going to be one moving object, with everything it could collide with being stationary (walls, circles and slingshotting around black holes). I had worked on this game on and off over three months of the summer and most of that time was spent trying to get one ball to bounce correctly off those various surfaces, or ensuring that it would bounce at all and not just pass through the object.

Ultimately it was never finished. The last version of the game was complied on the 27th of August, full of debug code...

(hit r to reset if the ball gets stuck somewhere)

The aim of the game was:

Hit each of the targets in sequence. There could be up to eight, where they were coloured red, orange, yellow, etc. Each time you hit the next in the sequence it played a musical note on a scale.
The player first places the ball within a small starting area and then aims where to shoot the ball (fine-aim with mouse-wheel or x/c). From then on the player has no control as the ball bounces around the level, hitting targets and traps.
You started out with 3 hit-points. Each time you hit the next in the sequence you got an extra hit-point. Each time you hit some spikes you lost a hit point.
When you got to 0 hp the level reset.
Getting too close to a black-hole and falling in would reset the level.
If you have more than 3 hp you could spend 3 hp to stop the ball in its tracks so that you could re-aim without resetting the level (single-click while ball is moving).
When aiming you could increase or decrease the length of the aiming guide line (up or down keys), which would have modified the amount of points you could get (the longer the line the fewer points you would would get during the level)
For each level there would be at least one way to aim the ball in such a way that you could hit each target without losing any hit-points (a perfect completion)

Those last two were what probably lead to me dropping the project (or at least turning a break into an indefinite break). Although there were still some annoying collision bugs to iron out, most had been taken care of and I was beginning to move on to actually creating levels. I hadn't made a level editor, instead defining the levels in text files as a list of objects and their positions and orientations. This is what originally lead to the extendible aim guide in order to try and find at least one perfect route per level. It was a rather clumsy way to go about building a level; I'd enter an object into the text file, recompile the flash movie, play the level to see how it interacts with the path of the ball, make adjustments in the text file etc. etc., all the while the aim guide was buggy in its own collision detection.

Luckily before I got too far in this mind numbing process I noticed something odd about how the ball would bounce off the circular targets. A small difference in the approach trajectory of the ball to a circular target made a larger difference in the departing trajectory. When trying to aim the ball so it would hit multiple circular targets in succession, a tiny initial fine-tuning in aim resulted in a massive difference in the path after a few bounces. Whether this is just a property of collisions between circles or as a result of my code, it would have taken the only form of skill and control away from the player, leaving them with just a shoot and hope strategy, as well as making an already painful level creation process near impossible.

I decided to put it all aside for a while, but then never revisited it to find the actual cause.

Back to square one
With my impending post-Metaplace attempt at entering the flash game scene, I hope I'll have learnt the lessons of my previous effort and start out with something a bit less chaotic. A bit more mundane. Like a colour-matching game!
It was in the middle of my 3,487th game of spider solitaire (on medium I must admit) that I thought 'I could turn this into a simple match-5 game, with coloured shapes in place of suited cards!'

So come January 2nd that shall be my task, and I give myself... oh, lets say two weeks to get it done!

Metaplace is dead. Long live Metaplace!

Tue, 22 Dec 2009 6:29:24 GMT

So we got the news yesterday that Metaplace.com will be closing down as a User Generated Content platform at the end of the year, a little over two years since alpha testing first began. My sentiments pretty much echo those of Crwth. Metaplace had the right ingredients, but perhaps just needed a pinch of something or other and a little bit longer to cook before serving.

I first got my hands on Metaplace, after following it from its announcement, only a few months after alpha testing started; and other than a handful of days where I hadn't been online, I've been there every day since. Even during the weeks when I didn't even touch the building tools I was always sitting in Plain Old Chat keeping up to date with the goings on of the community.

To me Metaplace was a way to help me understand the making of games, providing an engine for rapid prototyping and a great way to get rapid feedback from the community. I tried a number of projects with varying levels of success, the best of which ended up as featured content in Metaplace Central.

Initially I thought the appeal of Metaplace was that it was going to allow people to make their own little mini MMOs (mMO?), but for a large part the visible community ended up being a bunch of 12 year olds pretending to be 14 year olds looking for 'boyfriends' and 'girlfriends', whatever that means in a virtual context. The more dedicated builders began to retreat into various unseen corners while still creating some great content in the form of Adventure games or Platform games or other interesting experiments.

Over time I had been making little MMO systems, such as health bars and skill toolbars, for people to use to try and make games; although I could probably have made them a bit easier to use! I only just recently started to pull these together myself in an attempt to create a group based dungeon crawl. It had been a while since I had made anything in Metaplace and working on this, coding AI, making walls disappear when you walk into a room etc. was getting me excited about the whole thing all over again.

I was also just starting to help work on Crwth's HTML5 client, which I was finding really interesting.
But alas, it is not to be.

I'll be interested to see what now becomes of the Metaplace platform. I'm thinking we will be seeing professionally created games come out of it, rather than the "virtual worlds for everyone" approach.

All the time I spent on Metaplace was time well spent. I learned a lot, got to know some great people, which will all undoubtedly have an effect on whatever future projects I end up working on.

DIY Wedge: more control!

Tue, 20 Oct 2009 2:02:33 GMT

Last week I finally got around to adding an azimuth fine tuning controller to my diy equatorial wedge, which is little more than a bunch of M6 fittings fixed to both the wedge body and one of the bolts that attaches wedge to the tripod. I only just got around to it as I the original bolts I got for the tripod were not long enough (there were in fact flush to the tripod body), so I had to go to a specialist trade shop again to get the mtyhical UNC thread bolts and nuts.

When the tripod bolts are loosened I can then use the wing nuts on the side mounted azimuth control to make slight adjustments to the azimuth angle when attempting zero in on Polaris while doing a 'wedge align' as a part of the equatorial alignment setup; there is enough give on the size of the bolt holes on the wedge to allow some rotational movement.
Hopefully this works out better than the disastrous results that come with picking up the entire gear and trying to shift it slightly one way or the other!

Now I just need some clear skies... on a night that is not too cold please!

Anatomy of a very Metaplace hack

Tue, 29 Sep 2009 6:10:06 GMT

There are those in the Metaplace community - those who inhabit the dank, dark avatar-less backwaters - who strive to know as much as possible about inner workings of the system. Those who make clients, who probe for weaknesses in closed-source scripts, who still mourn the loss of OutputToUser(), and get very grumpy at undocumented changes.

When server update notes are released they don't just look at new features thinking 'how could I use this in a game?' but also 'how could this be abused?'

One such update that started a spate of devious thinking was the inclusion of the UiPickable() function and its pending support in the client. This function would allow a UI element (and any child elements) to ignore mouse-clicks, making them fall through to whatever was underneath. Now this has some obviously helpful uses such as with avatar name tags; these are pieces of UI attached to objects in worldspace that can sometimes get in the way of mouse-clicks intended for movement. But it could also be easily abused, and it didn't take long for Crwth to think of a way to use it, with the intended target being the user-to-user coin gifting.

Coin gifting (which has only recently been removed again in preparation for testing "Real Money" systems) was an in-world functionality that allowed one player to give some of their fake Metaplace play-dough money to another player. This was all safely locked away in the Secure Features module, which relies on closed-source scripts for its security. Closed-source scripts, if used correctly, can be very good at keeping your code and data locked up tight. Although this hadn't always been the case - there were times when they were not so closed and exposed their data to anyone! - by the time coin gifting came around they were pretty secure.

If you wanted to exploit coin gifting, for example trying to get someone to give you more than they wanted to, then you couldn't do it by trying to change the data within the secured gifting 'session'. But coin gifting did have a weakness; it required user input. The user needed to enter the amount of coins they wished to transfer and then again approve that transfer on a confirmation balance window. The user has to trust that the User Interface displayed to them is accurate and that they will only be transferring the amount they expect to.

Crwth's idea was to exploit this trust by placing his own UI on top of the 'real' UI. The fake UI would use UiPickable() to allow the button clicks to pass down to the real UI, which was using different values than what the user expected. But it wouldn't even have to be similar UI; a user could think they were playing a game in someone's world, but really they were transferring their coins to the world owner.

At the time this was discussed there was still no support for UiPickable in the client, so it couldn't be tested, but that didn't stop me from trying to implement something similar.
This vector of attack relied on the user actually wanting to perform a coin transfer and conning the user into transferring an unwanted amount by making subtle tweaks to the actual coin transfer UI itself.

On to the gory details:
A coin transfer was initiated from the context menu on a user; you would click the user you wanted to give coins to and select the option from the menu that popped up. This started a session from the mpsec_start_coin_gift trigger. Since it used a trigger you could write a script that also had a version of this trigger, attached to the player template, so you could know when a transfer session had started and which user was the target. This on its own doesn't do you much good; while you could block the actual session from starting by preventing other implementations of that trigger from firing, you couldn't really put your own fake transfer in its place, as only the 'Secure Features' script has the privileges to perform an actual transfer. But it did allow your script to know when to try begin exploiting.

Since my script (or any likely attacking script) was attached after the 'Secure Features' script, my version of the trigger fired first. By this point there was no session and no UI to try and meddle with. So I used a SendTo() to fire my own custom trigger but with a delay of 10ms (it would actually be about 30ms on average in practice due to the time it takes to set up a new execution frame). By the time this trigger actually fires the coin transfer UI will have been built, but in order to do anything to this UI you need to know what its ID numbers are.

Each UI creation function returns a User Interface ID which can be used to manipulate that UI element after creation, such as attaching, deleting or changing values. In order to use these values you have to manually store them as they are not publicly accessible from anywhere else. So how can you get your hands on the IDs for already created UI that you did not make?

The IDs are created sequentially; if an element you just made has an ID of 15 you can be reasonably sure that the element created immediately before it has an ID 14. In our case we are trying to look for the UI almost immediately after it was created, before it has even had a chance to be sent to the client. If you waited too long there could be a chance that some other innocent UI was created in the interval and therefore spoil your attack.

I manually examined the MetaMarkup tags that are sent from the server to the clients and counted how many UI elements had been created for the coin transfer. Then in the first line of my custom trigger I immediately create a new UiElement and get its ID. I then subtracted the expected number elements for the coin transfer UI to get to its parent element. Alternatively you could just count back far enough to the individual child element you want to alter, such as the text field and the button, but going back to the parent demonstrates two weaknesses for the price of one.

I could now use the newly acquired parent ID and use it with the UiFindWindow() function, which takes a parent id and a target element name. So I used that to find the text field

Code: MetaScript
local uiId = UiElement(0,'my_window_finder', 0,0)
uiId = uiId - 9
local text_field = UiFindWindow(uiId,'amount_input')

This is the valid text field where the user enters the amount to be transferred. But instead of allowing the user to input their value here I made it invisible and changed the value to my own

Code: MetaScript
UiVisible(text_field,0)
UiText(text_field, '1337')

This will set up the session to transfer 1337 coins no matter what value the user inputs. But as of now the user has nowhere to enter a value, so I have to create a new text field that looks just like the old one.

Code: MetaScript
local submit = UiFindWindow(ui,'yes_button')
local text_field_bg = UiFindWindow(ui,'amount_bg')
local new_field = UiTextField(text_field_bg,'hack_field',10,7,145,15, 255,255,255, 0,0,0,0, 'mpsec_coin_gift '..user_id..' 1337', 100 )
UiButtonField(submit, new_field)

This finds the background element that was created for the real text field and submit button. The new field is then attached to the background in the correct place and its command has my hacked value appended to it, this is just in case the user tries to submit by hitting the enter key in the field rather than clicking on the submit button.
The new field is also attached to the button (I can't quite remember why I did this, and I can't test it any more to find out. I may have been trying to see what value the user entered to use it later on).

When the mpsec_coin_gift command was sent, it now used the 1337 value for the transfer, but before doing so it generated a confirmation screen that showed the users current coin balance, the amount to be transferred and then the resultant coin balance. This was a bit tricky, as at this point the displayed transfer value was 1337, which the user would surely notice as not being the value they entered. I would need to again grab that new UI and change it, but to what? At the time (as I recall) intercepting the command with the user entered value proved a failure so you'd just have to wing it, changing the value back to the default 100 and hope the user saw what they wanted to see.

Or this is where a bit of social engineering could come in. You could only ask a user to transfer you the value that would ultimately be displayed on the confirmation screen. So you say "send me 500 coins", they input 500, 500 is then displayed on the confirm window, but they are actually sending you 5,000.

Or there is the real engineering way. Don't hardcode in a value but set up up a new command that only you use and then use that to prime the value to the used. You agree a value to be transferred, then before they get to sent it you quickly fire off a command with that value so that it is used in the display.

The only wrinkle in these methods is that they both fail to alter the last bit of information, the resultant balance. While you can alter a value in a UI element you can not extract a current value, and a users coin balance is considered privileged information so you can't access it. You just have to hope that no one in their right mind is actually going to add up the values to see if the balances match.

I tried this attack once and only once... on the Metaplace developer who made the coin transfer code. I got him to try and send me 100 coins from within my world, but the value that popped over his head as the transfer finally went through was 1337!

Some may think that detailing all of this now in public is just going to help the exploiters, giving them a way to con the innocent Metaplace user. But I take the view that you can not know how to create a robust secure application unless you know the potential ways in which it can be exploited. After this was demonstrated, the coin transferring code was altered to help prevent this kind of attack. But it shouldn't be just the Metaplace developers who know how it could happen, everyone on Metaplace is a potential content developer. All builders and scripts should know those kinds of exploits (which is clearly why I am writing it on a site nobody reads!).

My as yet unreleased PayPal module faced the same problem and I used a similar method to combat it. This attack relies on someone else knowing how many UI element IDs to count back to in order to find the correct elements to alter, and also optionally the names of the elements used. This can be combated by casting doubts on those assumptions.

Code: MetaScript

--utility functions
function rand_ui_ele()
    local r = math.ceil( ((math.random()*100)/10) )
    for 1,r do
        UiElement(0,'fake ui',0,0)
    end
end
function rand_ui_name()
    return MD5(os.time()..':'..math.random())
end

--build our UI
rand_ui_ele()
local uiId = UiElement(0,'myParentUI'..rand_ui_name(),0,0)
rand_ui_ele()
UiLabel(uiId,'myTextLabel'..rand_ui_name(),0,0,'can you find me?!')
rand_ui_ele()
UiAttachUser(self,uiId)

This code creates a random number of UI element IDs before, in between and after each newly created piece of UI, which prevents someone from simply counting back a known number of elements. It also appends random strings to the ends of UI element names so that they can not be accessed that way.
This likely won't prevent all future attacks on UI, but it is a good place to start.

As for UiPickable()... well, we never did get support for that in the client (perhaps due to this demonstration?), which is a shame since there are cases where it could be useful, even safe. For example I see no reason why it shouldn't be allowed for UI elements that are attached to objects, in worldspace. Those will always be behind the screen level UI and so have no chance to interfere. It is also probably where it is more useful.