After GMing a rather magic-centric group for a couple months, I've joined a rather tech-centric group so I can get some play time in. Since the group I was GMing never really messed around with the matrix rules, I realized that I had a big gap in my knowledge when it comes almost everything Matrix.

Ryu's Introduction into the Matrix Rules helped fill in many of the gaps, but I'm still very fuzzy on Cybercombat. I'm hoping either he or someone else could help fill in the last few missing pieces.

Here's what I've been able to piece together:

1. To engage in Cybercombat, you must be aware of your target and within range.
   
   • For AR users, both the attacker and defender need to be within Signal range of each other.
   • For VR users/IC/Agents, both attacker and defender need to be in the same node.
   • If your target is unaware your presense, you get to test for Surprise.
2. Roll Initiative.
   
   • AR users use their normal Initiative and Passes.
   • Full VR users use their Matrix Initiative and Passes.
3. Cybercombat proceeds as per normal combat...
   
   • Attacker rolls Cybercombat + Program Rating (using Attack/Blackout/Black Hammer) vs. Defender's Response + Firewall (+Hacking if on full defense)
   • IC/Agents use their Rating in place of Cybercombat, Response, Firewall.
   • Damage is resisted with either System + Armor (vs. Attack) or Willpower + Biofeedback Filters (vs. Black Hammer/Blackout).
   • IC/Agents and AR users are immune to the effects of Blackout and Black Hammer.

Correct?
Any steps I'm missing?

-paws

Good to hear that it helped.


To engage in Cybercombat, you must be aware of the icon you want to attack. (You attack the persona/IC, not the node. "Construct" should be the catch-all term.)

* Both attacker and defender need to be on the same node, so that the attacker can see the target icon. (Using a program on another node requires a subscription.)
* If your target is hidden, you need to find it with matrix perception first.
* I don´t think it is explicit that attacking makes you "visible".

Initiative and Resolution are fine the way you describe it.

That makes sense for full VR fights. And it jives with the these cheat sheets, which I just rediscovered. Of course, those are pretty much straight out of the BBB.

I guess what's really throwing me for a loop here is AR.

If two AR users are fighting, they're really not in the same node since the only nodes involved would be their commlinks. So unless one is hacking the other there is no shared node. Right?

Could one just launch an Attack program at the other designed to cripple their commlink? I would guess the answer is yes, but... I realy don't know. If this is the case though, then I'm guessing they only need to be within Signal range. Right?

I'm not sure if it gets stickier or simpler when you do AR vs. VR. I don't even know where to start. If the VR user is in the AR user's commlink node, I guess then you could handle it pretty much as a full VR fight (except for initiative, and other minor details).

-paws
Ugh. What tangled mess.

If two AR users are fighting, they have to share one node, and that might well be one of commlinks. The persona of an AR user is present in all subscribed nodes, and in the originating node.

You see the wireless node of the targets commlink, subscribe to it, and attack the persona inside. Active PANs will accept outside subscription attempts, passive and hidden ones will require hacking.

Paws I think I get what your going for and sadly I don't how it works in the rules.
Here is my attempt at understanding your position and relating it to the rules. Disclaimer: I think I am wrong.

Often, its possible to lock up or confuse another system without logging in to said system. DoS attacks, are an example. The gap here is the attack program. Its used against Programs(including Persona type programs?) and a commlink isn't a program.

I don't think the rules have a special case for this example. Think of twisting the color instead. The hacking skill and exploit programs are used to find the weakness in the system. Normally, this is described as gaining various levels of account access. There is a direct parallel here. Some exploitable services run as users, security or root accounts. What you are looking to do, and again I am likely wrong, is to

* Find an exploitable service
* Attack the entire node, such as an commlink

Which comes down to

* Hakcing + Exploit, to find the exploit, with a threshold related to the privileges associated with the service.
* In defense the system rolls Firewall (Plus system?) to try to detect the attack
* Once in you do your damage. If "Got Root?" then Command + Computer Shutdown.

The main change here is that you are not using the attack program. But you are still "attacking" the other commlink.

Sorry if I am way off.

A commlink provides both a node and a persona.

The node of the commlink is set to active, passive, or hidden mode.
- Subscribing to an active node is no problem
- Subscribing to a passive node requires hacking to gain access
- as does subscribing to a hidden node, which you would also have to find with WiFi-Scan first.

Once on the node, you can attack any constructs present on it, provided you can see their icons. The commlink users persona is always there, but might also be hidden.

Okay, I think I'm starting to wrap my brain around this. (Finally! )

So, if you walk around with your commlink in Active mode, you're a target, though there's not much a malicious script kiddie can do with just the attack programs. Other than be a minor annoyance.

What if you're in Active mode, running a Hot Sim modded sim module? I suppose you'd still need to hack the system to get at the persona before you could Black Hammer them. Or could you immediately access it because its in Active mode?

-paws

If someone is in Active mode running Hot-Sim, then someone could subscribe to them and start Black Hammering them right then and there. Suffice to say Active + Hot-Sim = not a good idea.

Running around in active mode with a hot SIM-module is asking for Blackhammer attacks, yes. Attackers still need to perform a log-in action (public account), but active nodes will accept subscription requests, so no problem there.

Just remember you can attack the node/system itself in an attempt to crash the thing. If you're walking around in Active mode and some script kiddie logs in, he can trash the hell out of your commlink, forcing a reboot. Much like your bally-hooed DDOS attacks. Though it does raise the question - do you actually need to log on to a node in order to attack and crash it? Rules-wise, I think yes. But fluff wise... ya' think?

There is a misunderstanding here. An active node (we'll say its a commlink) can be automatically found, with a Free Action. But the Active, Passive, or Hidden Mode does not make it easier/harder to subscribe to the node and attack someone - it just dictates how easy (or difficult) it is to find the node.

Connecting to the commlink requires different measures: either a data exchange or a subscription. A data exchange is easy, if the commlink it is in Active mode and has a public access area. You send the commlink your Access ID and a simple connection is established. [note that commlinks, or any node, may disable the public access feature] You can see the personal profile, public blogs, and that sort of information that the person chooses to broadcast. It is important to note that with public access-where you only exchange your Access ID- there is no subscription. This is simply a Data Request (see p. 54, Unwired), which includes the following: Audio/Visual communication, social networking, website requests, database access, file transfers. There is no log-on action.

In a public access area, you cannot attack anyone. There is no subscription between you and the node.

(Unwired, p. 53)


If you want to attack a persona in a commlink (or any node) you must get an account on that node. This requires hacking a User account (or higher):

(Unwired, p. 52)


While many people may have their commlinks set with little security, it is possible to set your commlink to only allow Security or Admin accounts, meaning hacking it will require a +3 or +6 threshold. They can also have their persona running stealth, making it difficult for you to find (and attack) their persona.

Yes, you need to log onto a node to crash it.

EDIT: Nothing to see here, shouldn't have said anything. Sorry.

In my Example, it was log in as root and shutdown. Still possible, yes?

I know its not colorful.
.
As much as I appreciate your answer, it burns part of me inside that it refers solely to Unwired. I even own the book, which I love. Just wish the answers were squarely in the BBB for something this simple.

The BBB only lists three account access levels: User, Security, Admin, and then goes on to describe the process of getting an account on a node under one of those levels ["accessing a node without authorization requires hacking" p 220]. Without the Public Access bit mentioned in Unwired, the question of if you can attack a persona in a node without hacking yourself an account on the node first isn't relevent. (ie, I used the Unwired quotes because the question is one raised by the expanded info in Unwired)

It is true the "Crash Program/OS" action on p. 223 leaves it open for question on whether you need to be in the node to crash it. You do need to be in the node, however. The text could be written much more clearly.

Learn something new each day! Thanks for the correction.

Check me on this if you will.

A matrix node can be set to active, passive, or hidden mode.

• Active: The node is visible and set up to react to data requests from all other nodes, the "Public Access" rights determine what information and services are available.
• Passive: The node is visible, but only reacts to data requests from defined nodes/users or upon individual confirmation.
• Hidden: The node is invisible, and only reacts to data requests from defined nodes/users. Sending a data request to a node makes you visible for that node.

Subscriptions:

• A subscription has nothing to do with the commlink mode; if you know that the node is there, and have the necessary access rights, you can subscribe. If you don´t have the rights, you need Exploit.
• Most user access rights permit you to subscribe a node, as do all security and admin access rights. A subscription is not required for activities that can be handled via data requests, but you would likely want one for encryption alone.
• Only the personae of subscribed users are visible on the node, even if you might be supplied with a "currently online" list.

Adding on to Ryu's excellent summary:
* You must have a Subscription (and thus at least User level access) to a Node in order to perform any action beyond a Spoof
* All of these rules apply in AR or VR mode. The only difference between the two modes is the Initiative rolled, and the way the digital world is displayed to the user.

I'd agree with both summaries.

mode examples:

active: your basically carrying a big virtual sign with a arrow on it, pointing towards you, along with name and phone number in big letters.

passive: you no longer have the sign, but you still have some kind of ID on you, and your phone will accept any incoming calls.

hidden: you have discarded all forms for ID, and your phone only accept calls on your list of known numbers.

the best way to envision AR is like a laptop of today, only that the screen is a image displayed on your sunglasses, and the keyboard and mouse is a similarly faked, accessed via finger and hand movements read by trodes, jack or gloves.

btw, i discovered something interesting. when a persona is crashed via cybercombat, the user may suffer dumpshock (if using VR), but the comlinks node do not crash.

the thing that made me reread the damage part of cybercombat was that having a node crash along with a persona made little sense for a nexi, that could handle multiple persona.

so the only way to crash a node is to get in there with ones own persona (or send in a agent) and use the crash program on it.

it seems more and more that the age of VR combat is gone. replaced by AR combat performed by hackers with wired reflexes or adepts. no dumpshock when a persona crashes, and no way for black hammer or blackout to harm one, especially if working by way of glasses and gloves, rather then trodes or jack.

one thing about getting a mental idea of the SR4 matrix tho, dont worry to much about direct radio range. ones one assume that one can go to any node out there, independent of it being in direct range of your own comlink, things become much simpler.