Implementing a score cheating prevention system in an offline game with an online score board: How to protect game fairness?

When the players want to edit stuff, they will find out how. Hardcoding attributes won't stop a determined modder for long.

So I would recommend you to do the only sensible thing and put that data in a config file. XML is just one option. Some people prefer JSON or custom formats because they are simpler to write and read. When you don't want to make the files too obvious, you could bundle resources as zip-files, but not name them as such. That way a modder needs to put in at least a bit of effort to find out which file format they are dealing with.

Hardcoding this data as constants in the code would be terribly unpractical, requiring a recompile of the project for every change. Even for small games this is very annoying.

To make the game data opaque, you either have to write custom binary formats or pack every text file into a compressed (ZIP) folder. You might even go to the extreme of encrypting the data, but I've never heard of such case for things like game assets.

Like it was commented before, players of your game with a bit more technical skill will eventually find a way to crack custom file formats and edit the game. But think again about this, do you really want to make your game like so? A frozen piece of software that will eventually get old and go out of production and no one will ever be able to improve it or fix it? I have a very open mentality on this matter, and as a developer, I always prefer to make the technical details of my games as open as possible, either by giving away documentation about custom file formats or editing tools that the player can utilize to mod the game. I find that this not only greatly increases the lifetime of a game but also lead to the creation of modding communities that will ultimately do a lot of free publicity for your stuff.

According to your comments the question is: how to implement some form of score board cheat prevention in an offline game with an online score board. Obviously, if the game is played offline, the least of your concerns is that players modify the game elements to throw off the balance, use that to win and post an unwarranted high-score. Your main concern would be that they simply send a couple of packets that say "Hey Mr. Server I got a really great score" and the server will reply "OK, I'm just going to stupidly accept this ... because you claim this to be true, it must be so" and done. They have any score they want with their name on it. What the server should say is "Pics or it didn't happen!".

In order to have some minimal control over the correctness of the scores I would suggest you make the game's behavior deterministic (in this sense):

• Any randomness needs to be controlled by a seed (so it's reproducible).
• Any floating point computation needs to be removed or replaced by a deterministic alternative.

Now record the players input during the game and once the game is over send the recording if the score is high enough to warrant being checked. Play the recording on the server in a checker and see if the official game constraints are broken. This does not prevent them from creating something like a "TAS" (tool assisted speedrun) with some hacks on the machine. For additional measures you may want to have form of control over the seed of the game like seed A is reasonable if the game was started at time T.

If you want to prevents players from cheating offline: that's impossible. If it were possible then people would have found ways to prevent users from cracking games in the first place.

If you want to add some measures to make it more difficult to cheat offline and then publish that as an achievement online then there might be some more things you can do but this really deserves it's own question.

BTW, encrypting the data and then decryption it during run-time is just a form of obfuscation and isn't considered a real measure of protection.