Detailed guide to hacking the Matrix. Includes a description of the interface, your offensive programs, and the intrusion countermeasures you will face. Strategies for exploration and tactics for handling countermeasures are explained.
Introduction
As you might expect in a Cyberpunk game, Hacking is an important component of Cyber Knights: Flashpoint. Hacking can be complicated, but with practice is fairly straightforward.
The first step to hacking is finding a Matrix Host. Hosts usually look like large multi-screen computer terminals, highlighted in blue if it is a Mission Objective or if you have turned highlighting on (toggle H). Any character can interact with most ordinary terminals, but Matrix Hosts allow a Hacker to plug directly into the local Matrix Interface and manipulate the system from within. Only a Hacker can use a Matrix Host without authorization. Move the Hacker near the Matrix Host, then click on the Host to begin hacking.
The Interface portrays the Matrix as a maze of Nodes and Connections. Programs are listed at the bottom of the Interface. Programs must be loaded (by clicking) before they can be used. The Scan Program searches Nodes for enemy programs, called Intrusion Countermeasures or IC. Other Programs are used offensively against IC. Programs should be prepared in advance before they are needed, because some IC will try to deprive you of your offenses. The Hacker connects from one Node to the Next, checking for IC. Various Nodes provide opportunities to steal paydata or to control remote physical devices. Spiking the Central Processing Unit (CPU) or Alarm Processing Unit (APU) will affect the Security AI for the entire level. Beware that the Security AI will react whenever the Quantum Security Level escalates, taking action directly against the intruder or indirectly by raising defenses.
Note: Images will be added soon.
The Matrix
Matrix Action Points
Most activity within the Matrix expends Matrix Action Points. Normal Action Points are converted to Matrix Action Points when you jack in, at a ratio of 1 AP -> 10 MAP. It is a bad idea to enter the Matrix with only a few Action Points because you may find yourself unable to load enough defenses on the first turn, sitting in a Node with hostile programs and the Quantum Security Level rising, waiting for the next turn.
The current Node is highlighted in green. If the current Node is selected, a window pops up to the right of the Node displaying the current Matrix Action Points, as well as how many Action Points would be used to Scan the current Node.
Security Level
The Matrix Interface portrays the Matrix as a maze of Nodes and Connections. The Nodes come in a variety of types, from firewalls to storage to processing units. Most Nodes contain defensive software, the dreaded Intrusion Countermeasures or IC, pronounced Ice. IC is controlled by the Security AI. The upper right corner of the Interface displays the Quantum Security Level (QSL), each level broken into Quantum Security Tally. Tally accrues as the IC and AI detect suspicious activity, until it triggers a higher Quantum Security Level. A certain amount of Tally is added even if you do nothing during the Turn, the Hacker’s mere presence in the Matrix tickling the security feelers of the AI. The AI reacts to each QSL escalation by selecting among it’s programmed responses.
Keep a close eye on the Quantum Security Tally. When it gets close to filling a level, you can expect the Security AI to increase the defenses soon. The log below the QSL bar will describe the responses, which could be deploying new IC, reactivating disabled IC, teleporting the Hacker to a new Node, raising the base rate of Tally, or various other things. Be especially wary if the AI deploys or reactivates IC; even the Nodes you have already cleared may not be safe afterward.
Responses become more and more dangerous as QSL goes up. To the left of the QSL bar are two values. The Host Security Level (from Green to Ultra) shows the initial security response of the Security AI. The Host Response Level (from mild to extreme) describes how quickly the response rises from minimum to maximum. Togther they indicate how difficult the local Matrix is to hack. Fortunately, by the time you start facing high security AI, your Hacker should have better tools to keep Quantum Security Tally down and handle IC.
Health
In the upper left corner are some statistics about health. This includes the Hacker’s physical health, the health of their Cyberdeck, the connection health, and the Matrix Armor. All of these can be damaged by Intrusion Countermeasures–yes, the Hacker can suffer physical damage from some extreme forms of IC. Matrix Armor will absorb some damage directed at the Cyberdeck. A Cyberdeck whose health drops to zero is “bricked”, worth no more than a paperweight. It can no longer connect to the Matrix and must be replaced. [As of v1.0.27, Cyberdeck repair and purchase is unavailable. To make up for that, Cyberdeck Health is automatically restored to 100% when the Hacker returns to the Safehouse.] Connection Health measures the quality of communication between Hacker and Matrix. Using certain Programs or Talents can put strain on the system, reducing Connection Health. Other Programs and talents can repair Connection Health. If Connection Health drops to zero, the Hacker will be kicked out of the Matrix.
Programs and Talents
The bottom of the Matrix Interface is devoted to Programs and Talents. In the bottom left corner are some measures limiting Program deployment. Programs are stored in the Storage Memory. Before a stored Program can be used it must be copied, or loaded, into Active Memory. Each Program has a size in Memory, and the Cyberdeck has a limited amount of Active Memory for loaded Programs. The Deck I/O defines how quickly things can be loaded into Active Memory. Loading a Program uses I/O, and only a certain amount of I/O can be used per Turn. Unloading a Program from Active Memory does not use I/O; it is simply a matter of deletion. The Program will continue to be available in Storage Memory for loading again. Deck I/O refreshes at the beginning of each Turn. Loaded programs will remain in Active Memory Turn over Turn until their charges are used up or they are unloaded, freeing up Active Memory again.
To the right of these measurements are icons for the Programs themselves. These are the programs available in the Storage Memory of the Cyberdeck. You will have Scan Programs, three types of disabling Programs (Sleaze, Deception, and Disarm), pure Attack Programs, and perhaps other Utility Programs. Each is displayed with a type icon and pips indicating charges. Loaded Programs are marked with bold lines. A Program can be toggled between loaded and unloaded states by clicking. Be very careful not to accidentally unload a Program you intended to use! You would be forced to reload the Program before using it, wasting Deck I/O and Matrix Action Points.
To the right of the Programs you will see any Talents the Hacker has that can be used in the Matrix. The Talents will have charges and recharge times just like other Talents.
Hacking
First Steps
The first thing you should do when entering the Matrix is use some Talents and load Programs. It is a good idea to immediately use a Talent to protect your Cyberdeck and a Talent to increase the Deck I/O. Extra Cyberdeck Hit Points are good–any damage sent your way will use the extra Hit Points before the base HP. Extra I/O lets you frontload a lot of Programs before you start exploring the Matrix. Also use any Talents that will last the duration of the hack. It could be a problem if you get kicked out of the Matrix and have to reconnect, but it is usually better to have the benefit of the Talent as early as possible than to worry about losing it to a Hard Disconnect that may not happen. Talents will recharge eventually.
Next you should load a Scan program, and some means of dealing with every type of Intrusion Countermeasure. Sleaze, Deception, and Disarm Programs each disable a different type of IC–Passive IC, Active IC, and Trap IC, respectively. Attack Programs will directly damage and ultimately destroy any type of IC. You could load a Sleaze, a Deception, and a Disarm, or load a couple Attacks, or some combination. Just be sure that you can handle any type of Intrusion Countermeasure, because you will quickly run into all three types of defenses.
Scanning
Now you are ready to start exploring. The current Node is highlighted with green. You can look at a different node by clicking on it, and return to the current Node by clicking V. If the current Node is selected, you should see some information about the node, including its scan level: 0/2, 1/2, or 2/2. At 0/2, you cannot see any Intrusion Countermeasures on the Node or even the type of Node. Running a Scan Program will reveal type of Node and any Passive and Active IC present, raising the scan level to 1/2.
A basic scan (1/2) will not tell you whether there is any Trap IC hiding in the Node. Traps are hidden deeper than Active and Passive IC. Run a Scan Program again. If there is a hidden Trap IC, it will be revealed and the scan level will remain at 1/2. If there is no unknown Trap IC, the scan will rise to full scan (2/2) and all the neighboring Nodes will receive a basic scan, raising their scan levels to 1/2. In this way you can tell whether connecting Nodes have Passive or Active IC before you try connecting to them.
Note that if the scan level is 1/2, it is possible for the Security AI to add a new sleeping Trap IC during a security Escalation, which would not be visible until you Scan for it. Nodes with full scan (2/2) may be changed to 1/2, reflecting the fact that you no longer know whether the Node contains hidden Trap IC.
Intrusion Countermeasures
Passive IC will block certain actions. For instance, a Datalock will prevent you from downloading paydata. A Jammer limits your ability to do any action by reducing your Matrix Action Points. Locker prevents remote control of connected physical devices. Overlord is particularly painful–it prevents you from loading a Program. A Sleaze program will disable a Passive IC, or you can directly Attack it. Never connect to a Node that has Passive IC unless you have a means of disabling or destroying Passive IC. Connecting to a Node with Overlord and no way to get rid of it means you will have to leave the Node to load a Program for it. If the Node also has Tarpit or Firewall, which block Connection use, you are in deep trouble and may have to Hard Disconnect out of the Matrix.
Active IC takes direct action against an intruder every time the intruder does something (loading or running a program, downloading paydata, etc.). All Active IC are potentially dangerous. Tracer will generate Quantum Security Tally; it actually attaches to the Hacker and will follow you around until it is disabled or destroyed. The Scrambler unloads a Program from your Active Memory each time it is triggered. Buster damages your Connection, while Blaster damages your Cyberdeck. Matrix Armor and extra Cyberdeck Hit Points are important defenses against such damage. The Hammer damages both the Cyberdeck and the Hacker. Ice Pick is worse–it damages the Hacker and applies lingering Wounds. The most annoying is Daemon, which creates a new Active IC within the Node, making your problems worse. A Deception Program will disable Active IC, or you can destroy it with an Attack Program.
Trap IC is particularly dangerous because you don’t know it is there until you Scan for it or accidentally trigger it. Fortunately, Traps only react to a specific action. A Trap might trigger on downloading paydata, exiting the Node, disconnecting, loading a Program, using a Program, or anything else you might do. The Trap will also have a specific attack which executes when triggered. Diamond increases the Quantum Security Tally. Tunnel relocates paydata to a different Node. Tiger damages the Cyberdeck and Red Tiger damages the Hacker. Blackhole relocates the Hacker to a different Node. Slapfish forces the Hacker into a Hard Disconnect, dropping out of the Matrix. Tripwire re-enables all disabled IC on the Node, undoing all your work. Each Trap will have a single trigger, and any combination of Trap and trigger is possible. But the trigger is often associated with the type of Node. For instance, a Node which usually contains paydata will often have a Trap that triggers on downloading paydata. Trap IC can be disabled by a Disarm Program or destroyed with an Attack Program.
Exploration
Connecting
Moving in the Matrix is done by clicking on a neighboring Node (highlighted in yellow) and clicking SPACE. In general, you should never connect to another Node until you are prepared. This means both testing whether the neighbor has Passive or Active IC and being sure that you can deal with any IC on that node. Scan to bring the scan level of the current Node to full scan (2/2) so you can see whether the neighbor has Passive or Active IC. If the scan level is raised to full scan but a neighboring Node is still unidentified, it means that Node is a CPU Node. You cannot identify a CPU or any IC on it except by connecting to it and running a Scan within the CPU.
You should also check your Programs and Talents before connecting to the next Node. Make sure you have Scan loaded as well as any Programs needed to deal with the IC there. If you know that the neighbor does not have either Active or Passive IC, you can skip loading Programs to deal with that type of IC, but never connect without a way to deal with unexpected Trap IC.
CPU
The CPU is the Central Processing Unit of the local Matrix. There will only be a single CPU in the local Matrix, but there may be several Sub Processing Units (SPUs) to support the CPU. The CPU has several unique features. The CPU cannot be scanned from a neighboring Node, which means that you must connect to the CPU without knowing what IC it may have. Simply assume that you will face serious countermeasures and you won’t be wrong. If a full scan (2/2) does not identify a neighboring Node, that Node must be the CPU. You will have to scan from 0/2 up once you connect to it.
Doing a full scan (2/2) on a CPU initiates a system scan across the entire local Matrix. Half of the Nodes you have not identified will receive a basic scan (1/2), revealing their Passive and Active IC. This can be quite useful if you manage to get to the CPU early in your infiltration.
A CPU is never at an endpoint in the maze; it is usually at a junction with several branches. It is usually deep in the local Matrix, far from the Terminal Node that you enter through. If you are seeking the CPU, you can probably narrow the likely locations to just a few possibilities as soon as you enter the Matrix and look around.
One of the most important features of the CPU is that you can Spike it.
Spiking
Spiking is the electronic equivalant of shoving a stun stick into someone’s stomach. It will bring a processing unit to its knees. Both Central Processing Units (CPUs) and Alarm Processing Units (APUs) can be spiked. Spiking an APU will cause the Security AI to malfunction. Spiking a CPU is sometimes a Mission Objective. Spiking a CPU will also reset the Security Level to 0.
In order to Spike a processing unit, all Intrusion Countermeasures must be destroyed on the Node. Disabling is not sufficient, though it may be useful to disable them before destroying them. Use Attack Programs to cause direct damage to the Hit Points of the IC. When all IC on the Node have been destroyed (including any hidden Trap IC), you can click the Spike button.
Incinerator
An Incinerator Node will force you into a Hard Disconnect if you end a Turn in it. Be very cautious around Incinerator Nodes and never connect to one unless you are certain you can handle the IC and get out before the end of the Turn. Don’t waste time eliminating all the IC. Disable or destroy what you have to in order to escape and get out.
Paydata
Certain Nodes may have various kinds of paydata. A Data Warehouse may contain files, Manufacturing Data may have blueprints, and Finance Records may have financial accounts. A Sub Processing Unit (SPU) may have any of the three kinds of paydata. These Nodes do not always have paydata; they may be empty when you connect.
When paydata is present in the current node, it will appear on the left side of the Interface, above the Intrusion Countermeasures. Before downloading, you must disable/destroy any Datalock IC which will block download. You should also check for and disable/destroy any Trap IC which triggers on download. Be careful not to trigger a Tunnel IC, which could relocate the paydata to a different Node. When the dangeous IC is disabled/destroyed, you can click the Download button to bring the paydata into your Cyberdeck.
Data Warehouse, Finance Records, and Manufacturing Data are usually found at endpoints. Sub Processing Units will sometimes hold paydata, but picking up paydata will generally mean exploring the endpoints of the Matrix maze. If speed is important and paydata is not a priority, don’t bother connecting to these endpoints to see what paydata they have. If you connect to a Data Warehouse, Finance Records, or Manufacturing Data in an endpoint and find there is no paydata, just leave. The chance that you will trigger a Trap by exiting the Node is equal to the chance you would trigger a Trap by running a Scan. There is little point wasting Matrix Action Points on the Scan.
Once the team returns to the Safehouse, any paydata you downloaded will automatically move into the Cold Storage room of the Safehouse.
Control Units
There are two types of control units in the Matrix: Security Control Units (SCUs) and Remote Control Units (RCUs). As suggested by the name, SCUs manage physical security devices on the map. RCUs manage doors, gates, and machinery. A Hacker can disable security devices, open doors, and activate machinery from within the Matrix. When you approach a Matrix Host, you can examine the Host. The HUD will display links from the Matrix Host to each of the devices controlled by that Host.
When you connect to an SCU or RCU in the Matrix, the devices linked to that control unit will be listed on the left side of the Interface. Before managing remote devices, you must disable/destroy any Locker IC which will block control. You should also check for and disable/destroy any Trap IC which triggers on using a remote control. Then you can click the Disable button, Open button or other action which is available for the remote devices. Disabling security devices from the Matrix is equivalent to a powerful jamming talent that lasts several turns. Since managing a remote device costs a small amount of Matrix Action Points, you can choose which devices it is worth manipulating.
Security Control Units and Remote Control Units are usually found at endpoints.
Remember Talents
Keep an eye on the recharge times for your hacking Talents. Use Talents when you need to. If you spend enough time in the Matrix, Talents which last until the end of the hack can be used multiple times to give extra buffs. Talents which expire should be refreshed when you can. Remember to use special-purpose Talents when they are useful.
IC Tactics
When facing Intrusion Countermeasures, it can be confusing to decide which one to deal with first. Certain IC can cause more problems than others, and it is not always obvious.
Daemon
Daemon is a rare Active IC which summons new Active IC every time you do something. If you do not deal with it immediately, you will quickly be overwhelmed with dangerous countermeasures. Disable or destroy Daemon as soon as you see it. If you can use a Talent to disable IC, use that. Talents will not trigger hidden Traps.
Scrambler
Scrambler will unload a Cyberdeck Program every time you do something. That includes executing a Scan. This can be extremely dangerous, as even checking whether there are hidden Traps can cause your Disarm or Deception Program to be unloaded, preventing you from disabling the IC. When you connect to a Node and see Scrambler, it is usually best to immediately disable or destroy it before even running Scan. Do not try to Attack the Scrambler unless you are certain of destroying it immediately. Dealing with the Scrambler risks triggering a Trap IC configured to react to using a Program, but that risk is balanced by the risk of losing the ability to disable/destroy the Scrambler. Since reloading a Program will again set off the Scrambler, you can suffer quite a bit from IC before you get it under control.
If you see both Scrambler and Overlord (prevents loading Progams) in a Node, you should immediately disable/destroy the Scrambler; don’t even think about doing a Scan or anything else. The chances are too high that you would lose the ability to deal with either Scrambler or Overlord, with bad consequences.
If you can use a Talent to disable IC, that is best. Talents will not trigger hidden Traps.
Ice Pick
The next most dangerous Active IC is Ice Pick, which damages the Hacker and applies lingering Wounds. It is probably a good idea to disable or destroy Ice Pick before scanning for Traps; the guaranteed long-term damage from Ice Pick outweighs the merely potential danger from most Trap IC. If you can use a Talent to disable IC, use that. Talents will not trigger hidden Traps.
Known Traps
You may already know about a Trap on the Node if, for instance, you accidentally triggered it or are returning after a previous visit. Evaluate whether it is worth disabling/deleting the Trap before running a Scan. If the Trap would be triggered by running the Scan, it should definitely be dealt with first.
Scan
If there is no Daemon, Scrambler, or Ice Pick, the next step should usually be a Scan. Hammer and Blaster might cause some damage, but a hidden Trap like Blackhole or Slapfish could be a serious problem. Run the Scan and re-evaluate.
If you did have Daemon, Scrambler, or Ice Pick and used a Program to disable or destroy it, you have already confirmed that there is no Trap IC which triggers on using a program. You can safely deal with Active IC like Hammer and Blaster before doing Scan. However, do not load a Program until you do a Scan and verify there are no Traps triggering on loading.
Dangerous Active and Trap IC
Once you know what Traps are on the Node, you can decide which IC to disable or destroy next. Slapfish, Blackhole, Hammer, Blaster, Tiger, and Red Tiger are obvious choices. If you have temporary Hit Points, IC that causes damage may be less critical. Tripwire is a concern if there is a risk you will trigger it. Traps that trigger on loading Programs may be a priority if you will need to reload. Traps that trigger on using Programs will also be a priority.
Overlord
After dealing with more dangerous Active and Trap IC, you can work on Passive IC. If Overlord is present, that is the first Passive IC to disable or destroy because it would prevent you from reloading Programs. If you need to reload a Program to deal with Active or Trap IC, you may need to do something about Overlord earlier.
Other IC
Any remaining IC that will be in the way can be dealt with at the end. Jammer and Tracer should be handled before going on to things like Locker, Datalock, and Tarpit.
Ignoring IC
Sometimes you can ignore IC. If a Trap or Passive IC is set to trigger on an action you don’t intend to do, don’t waste Matrix Action Points and a Talent or Program on it. One example is a Datalock or a Trap triggering on downloading paydata when there is no paydata to steal. Similarly you can ignore a Trap triggering on disconnecting if you aren’t going to disconnect in this Node. If you are about to leave the Node, Diamond (raising Quantum Security Tally) might not be worth dealing with.
If you are going to disconnect from the Node, you should not ignore any IC. If any IC is enabled when you try to disconnect, the disconnect would be a Hard Disconnect which causes Dump Shock, a form of mental and physical damage. Disable or destroy all IC on the current Node before disconnecting.
