[BUG/EXPLOIT] Achievements and game.prefs

This is a cleaned up copy of the orignal post found on the GPG forums ( http://forums.gaspowered.com/viewtopic.php?t=33526 )

In the demigod game.prefs file, it says

Code
  1. Items = {
  2.                     'AchievementTeleport'
  3.                 },

(I bought that teleport mirror thingy)
I find it odd that it is saved that way consider you can just fill in the name of the item you want and there you go...
Also, if you can find out what number the achievement has that you want, you can also fake it.

For example, I have  

Code
  1. hema0121 = {
  2.                     progress = 24,
  3.                     goal1 = 24
  4.                 },

If you can figure out the numbers of the other goals, I think you can get the achievement fairly easily. How do you find those numbers? Simple, ask a friend that unlocked the achievement for his game.prefs.

Changing the goal1 to anything higher didn't appear to work because I think you also need to find the value for goal2 and goal3 etc as this may be hardcoded or in some lua file.

I saw the achievement  hema0102 in my game.prefs unlike the others it just said 

Code
  1. hema0102 = true
Now what achievement only needs to be true or false? Oh yeah, the win a game achievement. I changed it to 
Code
  1. hema0102 = false
and looked at my torchbearer achievements, the "win a game" achievement that I had before was now gone. If that works, then the other ones also work in theory but I suppose its a matter of finding the right values. I just found the files with the achievements in it and the values needed to get them.

I know its just a beta but uhm I'm gonna have to say this, fix please?
This system is just fundamentally flawed considering anyone can open game.prefs and anyone can trade game.prefs files to look at other people achievements that they have unlocked... I mean if one person would just unlock ALL the achievements, we'd know all the required values and thus everyone could copy paste from that game.prefs if that one person released it to the public though.

End of quote

5,604 views 5 replies
Reply #1 Top

This shouldnt be a problem for them to output the achievements into binary or serialize them so its not readable in any way.  I wouldnt worry about it unless it stays this way lol.  I was looking at alot of the lua files as well and noticed the entire demigod story is in the strings file as well as all the acheivement names and their variables.

Reply #2 Top

These will eventually be stored on the server I'm sure.

Reply #3 Top

Yeah, as AZ said, I think they will store any multiplayer data in Impulse or something, not just in your computer.  You might be able to manipulate singleplayer, but not multiplayer.

Reply #4 Top

Hmmm I suppose, it was just a total surprise to find it in game.prefs, ready to be exploited. It would be a shame if they didn't fix it as it would kill the game a bit. Although most of those achievement items aren't worth getting but since its a beta that might change.

Reply #5 Top

Yeah, and right now the achievements are per Profile in the game, not your Impulse account.