I hacked Magic the Gathering: Arena for a 100% win rate

My first real foray into Linux was inspecting network traffic with a program called ShowEQ for EverQuest. At the time, the traffic was unencrypted and had lots of juicy info in it. I used a hub to replicate traffic to my Linux box, and it would draw a live map of the zone and showed where the mobs, NPCS, and users were. It even showed what loot the mobs had on them so you could cherry pick certain ones. The beauty of this was that it was passive and impossible to detect. Eventually SOE wised up and started to encrypt the traffic.

&quot;I was totally surprised by this, because it means that a (mostly) fully-functioning bot capable of playing arbitrary games of Magic: The Gathering has a small enough footprint to run locally on your machine&quot;<p>I dont get that. Maybe I am missing something.<p>Lets say, the MTG AI was so intensive to run that it would be unreasonable to run on the customer&#x27;s machine - then I wouldn&#x27;t run it on the server either, since it would be quite expensive (and bot games in card games are usually not pay per play).<p>Also, servers are not magic - most of them run on the same x86 CPUs as the local machine, with a lower clockspeed than their desktop counter parts (but higher than (most) notebooks). Therefore, the only way to archive a lower Bot turn timer compared to running locally would be to use significantly more cores than the customer (usually 4-8, hence 8-16 allocated cores per player?!). Sounds like a nightmare, especially during peak concurrent player hours&#x2F;days!<p>If the CPU Player does not support multi-core, running locally should be faster in any case.

Congratulations again for the top story, Daniel! I was hacking on MTGA since you posted this article and spoke a little about that with you on GitHub [0].<p>For anyone interested, I&#x27;m _inactively_ working on an unofficial client of MTGA which does hardly anything meaningful for now. The vision is to provide some automation for playing ranked games and stronger bot opponents. Sadly I was distracted lately away from the project and am still puzzled how to make a good UI to see things clearly. I can&#x27;t even estimate when it will be barely useful.<p>Beside that, I&#x27;m still very interested in any game hacking story of Daniel and anyone else! Please tell me more about how to spot such bugs, how not to worry being banned after such hacking, how to `disclosing the bug to them` like @aethros commented, how to structure an unofficial card game client, and other stories. Thank you!<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;MayerDaniel&#x2F;mayerdaniel.github.io&#x2F;issues&#x2F;1">https:&#x2F;&#x2F;github.com&#x2F;MayerDaniel&#x2F;mayerdaniel.github.io&#x2F;issues&#x2F;...</a>

&gt; I would have thought that a game as complex as MTG would require a lot of overhead in terms of creating an AI opponent. But nope! You can actually check out all of the logic for Sparky, including a few places in the debug UI where WOTC developers reached a corner case that they felt was not worth implementing. I don&#x27;t blame them - MTG is a beast of a game to try to have full coverage for!<p>This is a huge understatement, since the game is <i>nearly</i> (no infinite loops) Turing complete, and people have a lot of fun with that. I assume there&#x27;s a lot of work already done on AI strategy for it though.<p>The post title should probably have a &quot;Show HN:&quot; on it too, since you&#x27;re posting it yourself.

On a related note, I have a blast playing old school magic 93&#x2F;94 with my son. Of course using physical cards. We travel to Madrid each year to participate in the world championship of 7pts Singleton. This summer my son placed #9 which I am very proud of. 7pts Singleton is such a wonderful way to play the game with diverse affordable deck-building and balanced gameplay ( <a href="https:&#x2F;&#x2F;7pts-singleton.com" rel="nofollow noreferrer">https:&#x2F;&#x2F;7pts-singleton.com</a> )

Pure client side game logic...<p>I once developed a small game. Sometimes, for responsiveness, you need to implement game logic on the client. But nothing says you can&#x27;t redo the logic on the server and that&#x27;s what I did.<p>It can be hard on a real time game like FPS or RTS, but there simply is no excuse for a card game.<p>I think for a card game like this you really want to send no more information to the client than a real player would see. So for example, rather than send the cards that the opponent has in hand, just send the number of cards that he has -- no more and no less than what you would see in a real game situation.<p>It goes without saying that any actions sent to the server are only speaking for you and not your opponent. So no, you should not be able to declare forfeit for your opponent. You should only be able to say &quot;forfeit!&quot; which the server interprets as your forfeit because you are the only player you have power over.

In League of Legends there was a division-by-zero bug with a certain champion and item which caused server to kick all players and then crash. Because the exploiter was being kicked last, their team gets the win while opponents get Loss Prevented because the game doesn&#x27;t have a normal result.

I love the accessible yet insightful level of detail in this post.<p>One thing I don&#x27;t understand is, in the case where you connect your bot during a real match, 1) why does the game allow someone to join mid-match, and 2) when the bot resigns, why does that count as your opponent resigning? If it&#x27;s creating a 3-player game, Player 3 conceding shouldn&#x27;t also make Player 2 concede.

This takes me back to the Diablo 2 days when you could connect an open server character (LAN) onto the official bnet (internet) servers by reusing the same connection packets. Since open server data was all saved locally, you could create all kinds of items that aren&#x27;t supposed to exist and the official server would still accept them.

Lol, i recently got into MTG again with MTGA. I did a quick decompile as its a Unity game and not il2cpp (not that it would have protected it that much) but I found some fun stuff too. Keys for their epic launcher build, some undocumented apis.<p>I never wanted to use it to cheat, i really just wish there was a battle log. What matches I won, what I lost, view the battlefied of a finished game, etc...<p>Gonna check this out, but hopefuly its patched quick.

How hard would it be to write a server emulator that facilitates LAN matches with all cards unlocked?<p>I have no interest in interacting with a glorified skinnerbox.

That&#x27;s very fun. This is a &quot;simple&quot; enough exploit that I sent it to my MTG group chat, I bet they can understand it without needing to understand any programming jargon beyond client&#x2F;server.<p>I&#x27;m simultaneously surprised something this simple worked, and also not surprised at all. He does make a good point, this is an effective way to provide a practice bot and not need to make many server side modifications. I understand why they did it this way. The problem is they didn&#x27;t make any server side modifications haha.<p>Edit: so far 3 of them have given me a lol or laugh emoji. This is excellent writing.

Great post. Thank you for highlighting that hilarious code comment.

This is buried but fascinating: magic the gathering is turing complete, probably even more complicated than simply uncomputable , and possibly the most complicated major real world game<p><a href="https:&#x2F;&#x2F;arxiv.org&#x2F;abs&#x2F;1904.09828" rel="nofollow noreferrer">https:&#x2F;&#x2F;arxiv.org&#x2F;abs&#x2F;1904.09828</a>

The thing that weirded me the most in the article out was seeing the &#x27;goto IL_1894&#x27; statements in C# code.<p>It brought back memories of error handling in VB6, and was rather unpleasant. I presume this is being done for performance reasons?

Wish we could hack the card-shuffler for MTGA. I can&#x27;t remember the last time I had a match where at least one of us didn&#x27;t have either no land or nothing but land.

MTG is not very interesting when actually playing it. Most of the game is building your deck. Thereafter the deck mostly plays by itself.

Kudos for a very well-written and educational post!

The TLDR is a little too short.<p>- Decompile C# for Sparky bot [a], rewrite Sparky to be a substitute online opponent, connect Sparky vs you online as if you&#x27;re connecting a human in a match, have Sparky auto-concede and jack your win rate.<p>[a] Note I thought was interesting was: &quot;C# is also really nice because it utilizes metadata tokens to associate elements of the compiled code with their human-readable names, which are still stored in the compiled .NET assembly. That means I can see all the function, variable, and class names that the developers wrote when they wrote their code.&quot; Which means its super easy to reverse engineer.

well... WOTC is a small indie game company