Help - Search - Members - Calendar
Full Version: Hacking a Drone
Dumpshock Forums > Discussion > Shadowrun
EN 429
I was wondering if anyone has a cheat sheet or crib sheet for hacking drones. If not a run through here would be good. I had SR3 and an SR4 (not 4A) who were recently questioning this process and I was hoping someone could straighten it out for me- from discovering the wireless signal to taking control.
Lanlaorn
I found this incredibly helpful, it's the crunch behind the "Game, Set, Match" story in the SR4A book's chapter introduction fluff,

QUOTE
Hacking a Drone Example

BEHIND THE SCENES
Netcat: Initiative 9, 1 Initiative Pass, Resonance 7, Cracking Skill Group 4, Software (Threading) 5 (+2), Willpower 5, Command 2, Exploit 6, Scan 4, Stealth 6, one registered Rating 6 tank sprite with 5 tasks.
Slamm-0!: Initiative 11, 2 Initiative Passes, Computer 5, Electronic Warfare 5, Hacking (Exploit) 6 (+2), Sniffer 5, Spoof 5, Track 5.
Rigger: As Drone Rigger, p. 101, SR4A, add Cracking Group 3 and Analyze 5 & Nuke 3, in cold-sim VR, and already subscribed to the drone.
Security Drone: As MCT Fly-Spy, p. 350, SR4A. With Firewall 4 and running Analyze 3. The drone is operating in Hidden mode and has orders to patrol a specified route and report specific suspicious activity.

Combat Turn #1
Slamm-0! flashes the sun off his reflective shades towards the drone, trying to get it to report back to the rigger so he can begin a Trace User Test to track the connection.
Netcat uses a simple action to call her registered sprite. She uses another simple action to use her E-Sensing echo rolling Resonance + Perception getting 4 hits. This allows her to locate the drone's node, and tells her that it has a System Rating 3 (E-Sensing Table, p. 146, Unwired).
The drone has seen something it doesn't recognize. It makes a "common sense" test (p. 245, SR4A), Pilot + Response, getting no hits. It contacts the Rigger (a free action) for further instructions.
Slamm-0! attempts to intercept the communication between the drone and rigger in order to begin tracking the Rigger. He performs a Capture Wireless Signal Test (Electronic Warfare + Sniffer (3) Test) (p. 229, SR4A), getting 7 hits and succeeding. This gives him a way to track the rigger's node, so he can get his access ID. Yes, this would be unnecessary in modern TCP/IP, but the Matrix ain't yer daddy's communications protocol.

Combat Turn #2
Slamm-0! begins the extended Trace User (10, 1 IP) Test (p. 232, SR4A); he rolls Computer + Track Test and gets 4 hits.
Netcat threads her Exploit complex form (no action required), getting 6 hits on her Software + Resonance Test and choosing to use only 4. She resists the fading of 4P (Physical Damage because the new complex form rating is greater than her Resonance) with her Resonance + Willpower, getting 4 hits and resisting it completely. She then orders her Sprite to Assist Operation for her Stealth complex form, a simple action. Her Exploit Complex form is now 6 + 4, or 10, and her Stealth complex form will be 6 + Sprite Rating (6), or 12, starting in Combat Turn 3 and lasting 6 combat turns.
Slamm-0! continues the Trace User Test, getting 3 hits for a total of 7.

Combat Turn #3:
Slamm-0! continues the Trace User Test with 3 more hits, reaching the threshold of 10. He has successfully tracked the rigger's connection - the rigger is in the campus security headquarters - and gotten the rigger's access ID. Slamm-0! can now spoof orders to the drone.
Netcat starts hacking-on-the-fly for an Admin account: an Extended Hacking + Exploit (drone's Firewall + 6, Complex Action) Test. Netcat rolls Hacking + Exploit and gets 7 hits. The drone gets to make a test to detect the intrusion, an Extended Firewall + Analyze (Netcat's Stealth) Test. The drone gets 2 hits.
Slamm-0! uses the rigger's access ID to spoof an order for the drone to change course. He makes an Opposed Hacking + Spoof Test against the drone's Pilot + Firewall. He gets 5 hits; the drone gets 3 hits.

Combat Turn #4:
Slamm-0! waits to observe if the drone accepts the spoofed order. He also uses a free action to confirm his dinner reservations (what a romantic!).
Netcat continues her hacking-on-the-fly. She rolls 8 hits, which added to her original 7 hits achieves the threshold of 9. Netcat now has an Admin account on the drone. The drone rolls Firewall + Analyze, getting 4 hits, for a total of 6; it does not detect Netcat.
The drone begins to fly towards the Chemistry building.
Slamm-0! gloats.

Combat Turn #5:
Slamm-0! continues to gloat.
Netcat controls the drone directly, steering it toward her window (Complex Action). If she needs to make any Vehicle Tests, she will use Pilot Aircraft + Command (a dice pool of 1, since she doesn't actually have the skill).
The Rigger calls up a status report (a free action) and then decides to Jump Into the drone (a simple action). Because the rigger has jumped into the drone, there is no more outside access to control the drone; it is overridden by the jumped in rigger.
Slamm-0! orders the drone to resume flying towards his window. Nothing happens.
The Rigger analyzes the drone's node, making an Opposed Matrix Perception Test against Netcat's Hacking + Stealth. He gets 2 hits. Netcat gets 5 hits.

Combat Turn #6:
The Rigger starts moving the drone toward the security building (costing no action when jumped into a drone). He again attempts to locate Netcat. He gets 3 hits; Netcat gets 5.
Slamm-0! unloads his Sniffer program (Simple Action).
Netcat attempts to eliminate the Rigger's Access ID from the drone's accounts list. Unfortunately, the clever Rigger has programmed the drone not to accept Admin account deletions. Netcat and the Rigger are at a stalemate.
The Rigger accesses the Access Logs, attempting to figure out what's going on.
Slamm-0! loads his Exploit program (Complex Action).

Combat Turn #7:
The Rigger scratches his virtual head and performs yet another Opposed Matrix Perception Test against Netcat's Hacking + Stealth. He gets 4 hits. Netcat gets 6 hits. (Makes you feel sorry for the guy, doesn't it?)
Slamm-0! performs a Hacking + Exploit (drone's Firewall, Complex Action) Extended Test. He gets 4 hits on his first roll, entering the drone with a normal user passcode. The drone rolls Firewall + Analyze, getting a lucky 6 hits; it detects Slamm-0! and an alert is triggered. This immediately has two effects: it creates a Restricted Alert (p. 238, SR4A) against Slamm-0! (it raises the drone's Firewall rating against Slamm-0! by 4) and it immediately loads an MCT Bloodhound (p. 71, Unwired), rating 3, configured to look like a pack of husky puppies. The IC starts a Trace User (10, Complex Action) Extended Test.
Netcat deactivates the IC, using a Simple Action (since she has an Admin account, this is an allowed action; otherwise, she'd have to roll a Matrix Attack against it).
The Rigger sees Slamm-0's icon and attacks with a Nuke program (p. 111, Unwired). He rolls Cybercombat + Nuke, getting 2 hits. Slamm-0! defends with his Response + Firewall, gets 4 hits, and dodges the attack.
Slamm-0! performs a Redirect Trace action, making an Opposed Hacking + Spoof against the IC's Computer + Track. He gets 3 Net hits, which would be added to the IC's threshold for tracing him (if it weren't for NetCat's interference).

Combat Turn #8:
The IC goes pop.
The Rigger attacks again. He rolls Cybercombat + Nuke, getting 4 hits. Slamm-0! goes on Full Defense, and so resists with his System + Armor + Hacking, and gets 7 hits, dodging again.
Slamm-0! chose to use full defense this turn, so he can only trade witty banter with Netcat.
Netcat compiles a rating 6 Paladin Sprite. She rolls her Compiling + Resonance, and gets 4 hits. The Sprite rolls its Rating, and gets 3 hits. Netcat needs to resist Fading damage of 6S. She rolls her Resonance + Willpower, gets 4 hits, and takes 2S. She uses a free action to order the sprite to protect Slamm-0!
The Rigger attacks Slamm-0! again. This time, he scores one net hit. The base damage of the Nuke 3 is 3, plus 1 from the Net hit, so Slamm-0! resists the damage rolling his System + Armor. He gets 2 hits, and takes 1 damage. This reduces his Response by 1 point!

Combat Turn #9:
The Sprite uses its Castling Power to protect Slamm-0!.
The Rigger attacks again. The attack is redirected from Slamm-0! to the sprite, which rolls its Response + Firewall (total 16), and easily shrugs off the attack.
Slamm-0! loads up his own Nuke program (not wanting to hurt a campus security goon).
Netcat delays her action.
The Rigger attacks again. The attack is redirected from Slamm-0! to the sprite, which rolls its Response + Firewall, and easily shrugs off the attack.
Slamm-0! attacks the Rigger, with his own Nuke program. He scores 3 net hits, which added to his Rating 6 Nuke, make for 9 damage. The Rigger only resists 3 points of damage. His Response is reduced to 0, which reduces his System to 0, and he immediately loses all subscriptions, dumping him from the drone and causing 5S in dumpshock for him to resist with his Willpower + Biofeedback Filter.

Combat Turn #10:
Netcat alters the Rigger's account to not allow movement commands. She then gloats (a Free Action).
Slamm-0! spoofs the drone using Netcat's access ID - something he already knows. Using her access ID, he orders the drone to fly into his window. He gets 4 hits against the drone's 2 hits.
The drone flies into the window, ending the contest, and finally getting Slamm-0! a date with Netcat (more on that in future books).
CanRay
You forgot Combat Turn #11 where Slamm-0! uses "Etiquette: Sleazey Hacker Boi" to convince Netcat to wear a dress. nyahnyah.gif
Udoshi
1) Find The Drone. There are multiple ways to do it.
The easiest is to use Sc

I do have a matrix crib sheet (from here), but its far from complete.

The first step is to find the drone's network:
The easiest way to do this is with a wifi scan. (If you haven't taken a look at the matrix section list of programs and also the list of actions do so now).
Using an Intercept Traffic command on its controlling rigger, and waiting for one to communicate to the other would let you eavesdrop on which command is being sent where, and snag its access id that way. (such as if the rigger sends a command, or the drone makes a 'wtf do i do test' and contacts its owner)
A Trace User might be faster than waiting, and is also handy for finding out generally where a signal is (per the list of information analyze can give you, the precise location of a traced user may be available under the 'other relevant information' option. I prefer using telematics infrastructure for my triangulation needs)
You could also use the access log to snag an AccessID to a connected drone, but that's more advanced stuffin unwired.

Next you have to get in mutual signal range, though you CAN use relays to accomplish this, if you're more of a remote hacker.
You gotta break the encryption before you do anything - including trying to intercept traffic (its been my experience that some GM's just forget that this program exists and that its common use, so cheap and everyone should have it.) If you have the encryption key already, its a simple action to decrypt something, I believe.

Then you can try to log into the node. You have some options in this. You can Probe or Hack on the Fly. If you have an account already, such as from pre-hacking, or managing to steal someone elses login info/id, then you could use it too. You're probably hacking, thoush and should decide what type of account you want to hack for

Then there is the Loading step. Its not actually in an official list of things, but there is a lot of stuff that happens at once when you cross the firewall to get inside a node, so its a good habit to start doing the Loading/Rendering step all at once.
Defending node may make a firewall test, depending on the method of entry. (Probe rolls once when you Log In, HotF rolls every time you roll)
Your Reality Filter rolls now, if you have one running.
If your analyzer program is in automatic(and it should be!) it will make automatic tests against things.
If there are any defending or Patrolling IC, they will probably make analyze tests to notice the Log On.
If the defenders also have automatic-analyzer settings, it may roll to see you when you try to make changes on the node too.

And once you're inside, you can make Analyze tests to spot things, Data Searches to find pay data, Edit Tests to make accounts, run your programs on things - whether its crashing, attacking, medic, tracing a user, or whatever. (i'm fond of finding controls and important things that would hinder the defenders, and Encrypting them).

There is also the mechanics behind the story Game, Set, Match. that gives a MUCH more in practical look to the matrix and how it works in a hack-off. The story starts on Anniversary Edition page 212, and I recommend reading them side by side.
However, I was hesitant to link it first because there are a few dev errors in the example- either it was written for 4th ed(not anniversary), or before Unwired, or possibly a brainfart.(the math for slammo getting nuked was off). Still, it is FANTASTIC for getting people in the mindset of thinking about what you can do with the matrix, and the dice pools you need to have available in response to actions.
Speaking of Unwired, you should read the Security Examples starting on page 79 or so, whether or not you're using the book in your game.

Happy hacking.
Udoshi
Dammit Lanlaorn, I was just typing that, you dumpshock ninja, you.

Still, its nice to see people jumping on to help the new guys.
CanRay
Always happy to pounce on the new people. wink.gif
Lanlaorn
QUOTE (Udoshi @ Oct 2 2011, 09:47 PM) *
Dammit Lanlaorn, I was just typing that, you dumpshock ninja, you.

Still, its nice to see people jumping on to help the new guys.


Yea I really like that example since it shows a lot of different tricks with a hacker, rigger and technomancer in the mix. Frank Trollman really tears into it though as an example of how crazy convoluted the matrix rules are, though.

He's not wrong either, Game, Set, Match showcases how crazy a very high Stealth program is and how there's way too much dice rolling for matrix work, entire firefights with multiple parties shooting and slinging spells would probably be less dicerolls than that heh.
Udoshi
QUOTE (Lanlaorn @ Oct 2 2011, 08:00 PM) *
Yea I really like that example since it shows a lot of different tricks with a hacker, rigger and technomancer in the mix. Frank Trollman really tears into it though as an example of how crazy convoluted the matrix rules are, though.

He's not wrong either, Game, Set, Match showcases how crazy a very high Stealth program is and how there's way too much dice rolling for matrix work, entire firefights with multiple parties shooting and slinging spells would probably be less dicerolls than that heh.



Its true. My table has actually introduced some houserules for technos that makes them more comparable to hackers, and curbs high-end abuse while still keeping them unique - 'a stealth 10+ nerf' is part of that. I could dig em up if people were interested.
EN 429
Udoshi,
You had some great sheets. I particularly like the NPC and premade squad sheets- I was looking for something like that to easily track wounds on NPCs. Perfect. Thanks
Mardrax
Aaron Pavao's website hosts that and some other things you might be interested in.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Dumpshock Forums © 2001-2012