Hello ladies and gents! I am about to run an SR4 campaign. As the rules have changed considerably from previous editions, I was curious if anyone has ever put together gameplay examples, particularly of Matrix actions. I did not see anything on the Wiki, but I thought I would ask here.

Thanks in advance.

If you don't get one before then, I'll do some examples this afternoon once I have a chance to get home and dig out my books.

hopefully someone beats me to the punch though!

looks like it has come down to me.

these examples use SR4A only and relatively simple (I'll leave it up to others to integrate unwired into these examples later.)
GM only information in italic
programs and device ratings will be in ALL CAPS; Skills and Attributes will be uppercased.

Our runner:
Logic 3 (+2 from Cerebral Booster Bioware) *edit: for a total of 5.
Cracking and Electronics Skillgroups at 4; all programs listed in SR4A at 6.
Commlink is custom and improved post character creation, system, response, firewall, and signal are all 6.
hacker will run AR unless otherwise noted. he has 2 passes in AR/cold VR (WRI/cold-sim bonus) and 3 in VR (hot-sim bonus) he also gets two extra dice in hot sim.

the hacker is currently running Analyze, Armor, Attack, Biofeedback Filter, Browse, Decrypt, Edit, Exploit, Reality Filter, and Spoof. (10 programs total) this is more than the SYSTEM rating of the commlink, but less than twice the SYSTEM rating, so RESPONSE is reduced by 1.

0.
After the last run, your commlink was made so you spend a few days in downtime fixing the issue: by making a Logic+Hardware (2) test: rolling 9 dice, you score 3 hits and easily complete the test in one go. your AccessID is now changed. for your team's convenience you re-associate your fake SINs commcodes with the new ID, that + calling them to let them know you're ready to go out for that soykaf after all takes about an hour.

I.
Ok, so let's say you're the team's hacker and the call has come down that you're planning to intercept a shipment en-route from the docks to a secure facility in Bellevue tomorrow night. Your first job is to get the shipping manifests for all the ships coming in tonight to identify the arrival time of the package in question (your johnson has provided you with the container number that was scanned when it left the port in Hong Kong.) so you log onto the seattle RTG from a cyber cafe in VR-cold sim and run a matrix connection to the SEATAC Port Authority Node, where you log on as a PUBLIC user.

SEATAC is a relatively low rating node, we'll give it a system of 4, response of 3, firewall of 5 and signal of 6.

* The first test here is between your Reality Filter and the Node's (that emerald city we've all grown to despise.) it's a low quality node but we'll pretend that it's not amenable to this sort of resculpting and make you roll it anyway. this is an opposed roll: the node's SYSTEM + RESPONSE vs. your REALITY FILTER + RESPONSE; system's 7 dice versus your 11; you get 1 net hit, enough to count. you get +1 response rating (returning our temporary score to 6.) while in this node and replace the dominant sculpt of the system with your own personal choice of the day: it now looks like a black and white spaghetti western.

II. Now, there's not alot you can get as a public user, but just for kicks you run a search for shipping manifests anyway. this is a BROWSE + Data Search test, of variable threshold (gm chooses based on difficulty, see pp230, SR4A)

* this information is protected, so any number of hits is sufficient to let the hacker know that the information isn't available at this access level.

III. So it's time to hack ourselves a new, shinier, user level. let's go for USER since that should be enough to get access to dock codes; just enough to get user access. we'll look at security and administrator access later. but first, we'll load up our STEALTH Program (bringing us to 11 active programs).

The player doesn't get to know the exact Firewall without analyzing the node, which he hasn't done yet; so just have him roll until he gets in; for each roll he takes, you roll an ANALYZE + FIREWALL (hacker's STEALTH) extended test. since we haven't specified the ANALYZE program rating of SEATAC before now, we'll pick the number here; 3 sounds good.

* this is a hack on the fly, which is EXPLOIT + Hacking (target's FIREWALL, complex action) with the system making a parallel ANALYZE + FIREWALL (Hacker's STEALTH) extended test in response to each test we make. hacker rolls his 10 dice and gets a lucky 5 successes; the system rolls its 8 dice and gets 2 successes. this is enough to get in and hasn't triggered an alert.

IV. Now we can re-run our Data search - this time it's threshold (6), so after two BROWSE + Data Search Rolls we find what we're looking for; it's encrypted though, so it's time to decrypt. I will link to my next post here once I come back from class and can continue...

IV. Continued: once we locate the file we first need to run a matrix perception test (pp228; in this case, unopposed because the file is not running a STEALTH program) this is a simple ANALYZE + Computer Test, each hit gives us one piece of information; we're checking for encryption and data bombs.

* after rolling our 10 dice on this test, we get enough hits (2+) to determine that it is not bombed but *is* encrypted.

V. Fortunately we already have decrypt running, so we can initiate cryptanalysis (pp230) immediately; this is an extended test but it's run without our input after the first action - we roll DECRYPT + Electronic Warfare (Encryption x2, 1 combat turn).

as GM you can choose the encryption, since this isn't meant to be particularly difficult we'll set it to 4.)

* so after obtaining 8 net hits (we'll say that takes 3 tests at 10 dice each, this time) the file is no longer encrypted and we can copy the contents to our commlink.

VI. while all of this is going on, a piece of roving IC is moving around in the system looking for unauthorized users. this particular IC is a Pilot 3, carrying Analyze, Armor, and Attack programs. It has initiated a scan for new icons, and our erstwhile file-thief is up on the block: this test is opposed because our hacker is currently running STEALTH.

* This particular opposed test is PILOT + ANALYZE versus the hacker's Hacking + Stealth. in this case it is 6 dice versus 10 dice, so it is unlikely to succeed; nevertheless, it is sometimes lucky so you should roll it. In this case, the Hacker gets 5 successes, the IC gets 1; the IC does not detect the hacker as illegitimate and moves on.

VII. Perhaps sensing that it's time to pull out, the Hacker executes a Log off action and returns to his home node to continue data mining his new paydata. He unloads STEALTH once he arrives, and loads up SNIFFER instead; running a SNIFFER + Data Search test on the files he pulled to cross-reference the container ID with the manifests, he attempts to identify the ship, shipment, and scheduled pickup time.

* This is another variable threshold extended test; in this case the GM sets the threshold to 4 and 1 minute. (it's a big file). rolling 10 dice on SNIFFER + Data Search (4, 1 minute) the hacker gets 4 successes on the first try, he's found what he was looking for.

VIII. Now it's time to both wire that information out to his buddies (free action) and set up for the next leg of the run, the interception. First, because he's anticipating getting his 'link detected, he spoofs his Access ID in software.

* This is a Logic + Software (2) test, the hacker makes it easily, takes a few minutes to reconfigure the routing software inside his link.

IX. Re-opening his matrix uplink he subscribes to the Seattle RTG again and locats Grid Guide - he unloads SNIFFER, reloads STEALTH, and prepares to probe the target. This is a time consuming but stealthy way to get superior access to a node. Because he is anticipating rerouting traffic for an extended period of time and maybe even causing intentional traffic jams with mistimed lights, he decides to err on the side of overkill and goes for a full admin access.

Gridguide is a popular node but at least, within SR4A only, no nodes have specific numbers. in this case the GM wants this node to be scary (it is MCTs shining badge of modern progress and a frequent target of hacking attempts after all. so we set System and Firewall at 8, Response at 6 and Signal at 3. (you'll note signal rarely matters for remote hacks, it does matter for on-site hacks...

* Probing a Target is an Extended EXPLOIT + Hacking (SYSTEM+FIREWALL, 1 hour) test. because we want admin access, we add +6 to this threshold. This results in a daunting EXPLOIT + Hacking (22, 1 hour) test. (at 10 dice per test, the hacker rolls 1, 4, 5, 5, 0, 8, successes. 6 tests and 6 hours later the hacker has a fresh admin exploit that he can utilize on the run tomorrow night.

GM note; exploits obtained this way do not last forever, they can be discovered by security admin on the node (I like to use edge tests for this), or erased as a result of reboots - this is to prevent a player from hacking dozens of these exploits on systems weeks or months in advance, "just in case."

X. Hacker logs out and gets some soykaf, while looking out his window he decides to spoof the toy camera drone floating over a nearby apartment and send it to watch over the docks while he gets a quick nap. (SPOOF + Hacking versus PILOT + FIREWALL.) in this case the short list of commands is to fly to a set of coordinates, take pictures every 3 minutes for 2 hours and upload them to an anonymous commcode for later retrieval by a teammate.

* This is a pretty straightforward test, since this happens to be a toy the PILOT + FIREWALL is likely to be very low, (say, 2 and 2) -> the kid won't be very happy but the hacker has a pretty deniable asset doing overwatch for him while he catches some shut eye.


will add more later.

Jericho, I really appreciate the effort you put into this. Paticularly for some guy with one post who might never poke back in. I was mostly just looking for a link to something pre-existing.

I'll hold more comments till you're done. Just wanted to let you know your effort is appreciated.

well it helps to get it down since I'll get critiqued at some point. most tables are using at least some of unwired though - so don't be surprised if this isn't entirely applicable.

I'll probably have another segment up in a few more hours, I remember an old SR3 thread that got well over 2000 posts that was something to the effect of 'matrix for dummies' but I don't believe it was ever recreated for SR4...

It's not out yet, but the Runners Toolkit will contain "Anatomy of a Shadowrun", a fiction and rules walkthrough of a typical run.

In the meantime, here is Dashifen's Walkthrough. LINK

Picking up where we left off,

XI. the hacker wakes up and meets the team onsite, they're sitting on a side street, in an unremarkable white moving van, watching trucks go by from the docks. this is where the Hacker gets to let his E-war skills shine. this time it's Data Search + SCAN, looking for the RFID tag the paydata from earlier said the box was marked with. once he picks up the tag they'll know the van is 40meters away and he can flip the light up ahead so they can get in behind it smoothly. He is now running: Agent(3), Analyze, Armor, Attack, Browse, Decrypt, Exploit, Scan, Sniffer, Spoof, Stealth. This program suite reduces his temporary reaction to 5, where it will stay unless/until he drops into VR and loads his reality filter. (he's in AR for now)

* In this case, it's easiest to just set an agent to the task, the device is a standard broadcast RFID and there's no reason to expect that a rating 3 agent running on your home node won't be able to handle it. as per Agent rules, the agent is operating with you and takes up a single program slot. Once the agent (rolling 6 dice per check, every combat round for hours on end if necessary^) finds the RFID, it notifies the hacker.

XII. While the Agent does this, the hacker decides to capture wireless traffic coming to and from the stoplight in front of them, so he can attempt to spoof a command to it rather than risk blowing his admin access to change just a single light.

* This is a SNIFFER + Electronic Warfare (3) test (complex action) the hacker rolls exactly 3 successes on 10 dice and gets the signals. Unsurprisingly these signals are encrypted, so now he Initiates Cryptanalysis; DECRYPT + Electronic Warfare (2x encryption rating, 1 combat turn extended test) this encryption is pretty stiff, rating 6. rolling 10dice, he gets 4 hits, 5 hits, and 4 hits, the hacker succeeds on the third combat turn. (a matter of seconds!; you'll notice that encryptions in SR4 are mostly meant to be used to slow down combat riggers; they're not really an obstacle to the modern hacker when he's not getting shot at.) the hacker now has the information he needs to attempt to spoof a command to the traffic light.

XIII. Time to swing into action! now that the agent has notified the hacker that his target is within 40metres, they get ready to manipulate the light to let them slide in behind it and begin their tail. (it's too close to the docks to take it here..) the hacker attempts to spoof a command to the light to switch it's state at the right time.

* This is an opposed test between our hacker's SPOOF + Hacking and the targets SYSTEM + FIREWALL (since the device in question is a peripheral and lacks a pilot) the hacker succeeds and the van slides in behind the truck.

XIV. Disaster! the driver has somehow figured out that he's being tailed (maybe it was the fact that the van stuck to him halfway across Tacoma...) it's time to do something quickly and save the day: the hacker drops into VR and uses his pre-hacked exploit to get in to gridguide and cause a major traffic snarl.

* even though the hacker already cut an exploit - the system gets on test against him, to see if he gets detected when he uses the exploit. this is the same ANALYZE + FIREWALL (Hacker's Stealth) test that was being used during the hack on the fly sessions. as GM we set the firewall to 8, now we need to pick an analyze program rating, let's use 6. rolling 14 dice, the System scores exactly 6 hits - the exploit still works, but an alert is triggered and an opposition hacker (called a 'spider' in sr4) is notified that there is an intruder in the system.

as per the rules on pp238 of SR4a, this is a restricted alert, gridguide's FIREWALL is now operating at +4 against the hacker, for a scary 12 rating. Spiders are NPC deckers, you'll need to know the following stats about them at a minimum: Matrix Initiative, Computer, Hacking, Cybercombat, Electronic Warfare, Program Ratings, Access Level (usually Security, sometimes Admin), attributes of their commlink if they aren't plugged directly into the parent node; and which programs they have actively running.

In our case the hacker is using his own system, also all 6s for simplicity; running 'only' Analyze, Attack, Armor, Biofeedback, and Stealth, each at rating 6, his actual skills are a little lacking though; he's a 4 Computer, but 3 Electronic Warfare and Hacking.

XV. Now is a good time to roll off initiative; glossing over the exact numbers, we find out that the Hacker is first and the Spider is second. There are no other actors currently. The first thing the hacker does is to launch his Agent and designate his Attack Program and Analyze Program for the agent's Use. this is his action for the turn; adding the Agent to the Initiative order we find that the Agent is going last.

the spider has to locate the hacker before he can attack him, so he runs a matrix perception check (simple action), looking for the intruder.

*this is the same opposed matrix perception check we've been using, in this case the spider rolls his ANALYZE + Computer (10 dice) against the hacker's STEALTH + Hacking (also 10 dice). The Spider gets 5 hits, the hacker only 3. the spider can now interact with the hacker's icon; his net hits also let him get the AccessID of the hacker, important information if he wants to spoof a command to his agent later..

for his second simple action, the spider observes in detail, locating all unstealthed icons, including the Agent.

The agent now acts, it must locate the spider (who is also running a stealth program), before it can attack, which it will do immediately if it succeeds.

*Despite being 'handed' a rating 6 ANALYZE program, the agent is restricted to its pilot rating (in this case, 3) on all programs it runs. the Agent is rolling only six dice. fortunately for our hacker, the Spider blows his opposed test, only getting 2 hits; while the agent manages to pull out 3.^^ the Agent can attack next round.


XVI. It is now Initiative Pass number 2, the Hacker is under the wire because he needs to make something happen fast, on top of that he doesn't even have an active attack program (since the agent is using it.); he decides to attempt to cause a traffic accident in the upcoming intersection. first he needs to find the icons to interact with them, so he observes in detail (simple action). then he issues a command as an authenticated (if flagged) Admin account and the lights at the upcoming intersection all go green at the same time.. (second simple action) in a few more seconds there will be a terrific collision and traffic will be blocked, allowing his teammates to neutralize the driver of the truck and then unload the contents, all hopefully before the police arrive.

some tables may handle this part differently, there's basically three ways to treat this: the first is that as admin in the system this is a 'null' test - all that's necessary is to find the Icon(s) that represent the devices you want to interact with (the lights) and issue a command. because the hacker is currently authenticated as an Admin user, his AccessID is authorized by the system and it should go through without issue. if the hacker had an insufficient authentication level, then it would be appropriate to require a SPOOF+Electronic warfare check instead of a null test.

the second option is to have the hacker to make a COMMAND+meat skill test; this is appropriate for certain sufficiently complex devices (like welders, auto-guns, etc.) many of these devices also have a pilot rating, what this allows the hacker to do is activate 'manual' control, but remotely. (e.g. with a joystick) since the lights in question are basically just switches this isn't really appropriate in this situation.

or finally, some other kind of strictly matrix test; frequently either an EDIT+Computer check or COMMAND+Computer check. this last doesn't really have any basis in the RAW but is a good fall back if you get into some kind of weird corner case where you want a test of some kind but don't know what to roll and SPOOF feels inappropriate.

XVII. Now the Spider goes again; he chooses to attack the hacker.

*MATRIX COMBAT; the attacks the hacker, his ATTACK+Cybercombat versus the hacker's RESPONSE+FIREWALL. 9 dice versus 12. He gets 4 hits, the hacker gets 2. this is a successful attack. the DV of the attack is ATTACK+Net hits (; the damage type is Matrix because it is an attack program.

The hacker rolls his SYSTEM+ARMOR to resist the damage, (12 dice) getting 4 hits, he takes a net of 4 matrix damage. he now suffers a -1 wound modifier to matrix actions; once the damage reaches 8+System/2 then the hacker will crash immediately.

XVIII. the Agent attacks the Spider now.

*MATRIX COMBAT; the Agent, despite being handed a rating 6 program, is limited to his pilot for program rating, so his ATTACK+PILOT is only 6 dice. the Spider's RESPONSE+FIREWALL is 12 dice. the Agent gets a generous 3 hits, but the Spiders pulls out 5 hits, so the attack misses.

XVIX. This is the end of the turn for the Spider and Hacker, although the Agent can act again. Instead of risking going after the Spider in the next round and possibly getting hit by something more dangerous, the hacker elects to jack out and suffer some stun damage (also so we can demonstrate how that works.) Jacking out when you haven't been hit by Black IC is a free action with just a damage resistance test in the event of VR; the dumpshock DV is 5S for cold sim and is resisted with Willpower + BIOFEEDBACK FILTER.

* Our hacker isn't running a BIOFEEDBACK FILTER and coach's cajoling never really had any effect on him in highschool, so he rolls just his 2 willpower, gets 0 hits, and takes 5 stun damage. in addition to the -1 wound modifier, he will have a further -2 penalty for disorientation for the next 8 minutes. He won't be much help unloading the truck, that's for sure - but at least the hacker did his job.


This is where I'll conclude my example play; glad to see Bishop was able to locate Dashifen's wonderful walkthrough, and proving me wrong about the guide not being recreated for SR4. I'd highly recommend reading through that as well.

If you have other specific questions you'd like answered, I'll continue to monitor this thread; welcome to the boards!



^At my table we'd just buy off this success with the 4:1 trade in rule; some GMs may make you roll it for the crucial few rounds when the device would actually be in range.

^^ Some tables may allow players to edge agent tests, mine does not. I do not recall if there is a basis in the rules for either stance, I'd check with your GM/make your own decision personally.

Tiger Eyes (one of the developers) posted an example guide to go along with the opening fiction for the SR4A matrix section Here.

I've noticed that there's a fair amount of arbitrary number setting on the GM's part. I find it difficult to be both fair and challenging to my players if I'm constantly having to make up numbers out of whole cloth.

I also noticed they've done away with the color coded Matrix node system (Blue/Green/Orange/Red).

How is this for a solution: bring back the color coding, which now indicates a range of Node Matrix attributes (System/Firewall/Response; Signal being seperate). Jericho's example of the SEATAC node sounds like it would be within the Green range, for example.

Is this a viable idea? Is there enough variation in the ranges and importance of a Node's Matrix attributes to make this a useful guideline for a GM to start with when determining how difficult a Node should be? (I can't recall if node ratings went above 6...don't got my book handy.)

If this isn't a good starting point, what tricks do you gentlemen use to make creating Matrix nodes (paticularly on the fly) easier?

Pick one number between 1 and 6. Now assume that every attribute of the Node is equivalent to that number as well as every program or IC the Node is running.

When making up any kind of opposition on the fly I usually classify it as: Trivial, Inferior, Equivalent, Superior, and Nigh-Impossible. These ratings are all relative to the player's power level. If the PC has all his programs roughly Rating 5, then a Trivial system is Rating 1 or 2, Inferior 3-4, Equivalent 5, Superior 6, and Nigh-Impossible is 7+. I'll use the same method for making up NPC opposition on the fly, giving them all skills and attributes relative to the players using the same system.

Hacking occurs so infrequently in my FtF game that I often make up stats on the fly. I kinda like Malachi's approach. You can determine the average rating of the hackers programs and gear and then say:

Trivial: -3 (minimum 1)
Inferior: -2
Equivalent: same (+/- 1)
Superior: +2
Nigh-Impossible: +3 (max 7 or 8 based on story)

Also if you have a bunch of spare time and want to listen to actual game sessions you can check out Zendead's Hidden Grid and MaxMahem's podcasts.

a color system would still be arbitrary.

Ideally, the nodes you're expecting them to hack (in my example this would probably be Gridlink since the run specified catching it on the move.) would be determined beforehand, same as any other npc. (same with say, the J's commlink, just like you'd determine his relevant magical stats for assensing etc.)

it's just you can't accurately anticipate every node your hacker will attempt to hit in the run; if filing them into colors is helpful for you to anchor your arbitrary decisions, then I'd encourage you to do so - I inserted the GM choices I would make while reacting to this particular hacker; since I create my npcs in a lazy manner (specifying only what I need to know when I need to know it.) it kind of bled through into my example.