This is a work in progress and it still needs a few additions (like a list of prices for the programs) and a lot of polish before I call it a complete chapter. But it's good enough for getting it up and getting some feedback. (You'll notice I haven't written thing one about Technomancers yet.)
In the interest of context, here were a few of my design goals (in no particular order):
* Make Character Attributes like Logic and Intuition actually relevant to Matrix Actions. Kind of a no brainer, doesn't need much more comment.
* Fix some of the things that EotM pointed out were broken, like Matrix Perception tests (Hackastack, etc).
* Streamline and simplify the chapter's structure as much as practical, reorganizing where possible, by removing excess verbiage, and redundant and confusing repeated descriptions of Matrix topology/topography.
* Present and embrace the idea that AR is directly analogous to astral perception, VR is directly analogous to astral projection, agents are analogous to spirits and
* Make DIY hardware the standard from the gate, rather than assuming technical geniuses would be using off the shelf crap.
* Make sure hackers can contribute meaningfully in meat combat, by hacking things in no more combat time than it takes to fire a gun or cast a spell. In other words, avoid the SR4 problem where on Turn 1 the hacker starts the process of hacking the enemy's gun or something, and on Turn 2 the street samurai has already shot that enemy's head off or the mage has exploded them with a spell. This was the most important one, and the one I'm not sure I went far enough on. Hackers do now at least have a way to consistently do this under my rules, but I want to give them more options than always defaulting to Brick Device (even if there are a panoply of potential devices to brick). But anyway this issue is a Big Deal to me.
Anyway I think my grasping at what I was trying to do is less important than what I've actually got so far, so that said, here is the text!
Shadowrun Perfect Crime Edition wrote:MATRIX - THE WIRED WORLD
In 2029, The Crash Virus destroyed the Internet as we know it, and the civilized world nearly came crashing down without that digital infrastructure to hold it up. A new virtual reality Matrix was built in its stead, creating a new digital realm. The Matrix may best be thought of as a plane of existence that overlies physical reality, much like the Astral Plane (see p. XX). While the Astral Plane is made up of echoes and representations of living beings and lifeforms, the Matrix is made up of electronic devices and data-forms.
The Matrix seen from within is a shared consensual hallucination of a virtual landscape or an alternate world. It is the digital representation of all of the Matrix devices in the world. When using the Matrix, data can be not just seen and heard, but touched, smelled, and even tasted. It is a far more intuitive and immersive evolution of the GUI (graphical user interface). The same Matrix technology that makes a wage slave's job simple gives power to unauthorized, renegade users. Deckers can leverage the consensual hallucination of the Matrix to their own ends.
I don't want to shed too many words describing what the Matrix looks and feels like. Other editions of Shadowrun do this admirably. What I want to focus on is establishing the necessary gameplay concepts to make actually using the Matrix in play clear and straightforward, something other editions of Shadowrun have struggled with.
The default rules layed out here describe the Matrix as of 2070, following the Second Matrix Crash of 2064. The New Matrix, or Matrix 2.0, uses wireless network protocols and features ostensibly ubiquitous connectivity. What this means, in practical terms, is that a decker (or any user) does not need to 'jack in' to a jackpoint to access the Matrix. Instead, your Personal Area Network travels with you wherever you go; the network is everywhere, a wireless mesh, and you can access it from any point: universal connectivity.
Later projects I have planned, not in the scope of these core rules, will dial things back to other periods of Shadowrun history when the grid was wired, not wireless, and when you accessed the Matrix by plugging your brain into a jackpoint.
MATRIX CONCEPTS
Your commlink is a computer the size of a mobile phone that allows you to be online wherever you go, 24-7. It is your portal to connectivity with everyone and everything that inhabits the wireless matrix. It is also, incidentally, a very fancy and fully functional mobile phone.
With a commlink, you can access Augmented Reality. Augmented reality (AR) overlays images, data, and Matrix feeds on your physical senses exactly like a personal HUD. This lets you call up and examine an area map, browse a store's catalogue, or read incoming e-mail and texts in real time without even having to look down. It also revolutionizes social networking and gaming.
If augmented reality lets you see the digital world (akin to astral perception, then full-on virtual reality lets you immerse yourself in that world. To the VR user, the real world is completely replaced with a full-sensory simulation representing the Matrix. It is commonly used by Matrix specialists, programmers, and professionals who benefit from VR environments in their work. It also sees widespread use as a form of extreme entertainment, including simsense memory recordings, gaming, and literal cybersex.
Each and every active digital device in the real world has a corresponding node in the Matrix, a digital "place" that represents the device's system and storage space. These nodes are where files are stored and where users work and play. Each device and node are linked--one is in the physical world and the other in the Matrix, two sides of the same coin.
Particularly complex or sophisticated nodes or collections of nodes that a Matrix user can go "inside of" are called hosts. This is where users work and play. The Renraku arcology, for instance, is composed of hundreds of interconnected hosts linked to millions upon millions of nodes representing the millions of devices present there.
Generally speaking, the Matrix is populated by icons, graphical, visual representations of people, programs, files, connections, data streams, or anything else interactive. When you interact with the Matrix and the nodes and icons in it, you do so using a persona, a digital avatar that overlays your physical being.
The art of grooming and controlling how nodes, icons, and personas look and (aesthetically) behave in the Matrix is called sculpting. (While there are no hard limits to what an icon can look and sound and feel like, it is generally considered polite for an icon to comply with basic accepted standards in size and presentation. For example, a five thousand foot tall godzilla icon in a VR node sculpted to resemble the inside of a small submarine would not crash the node or diminish the abilities of other icons, but it would cause some very ugly graphical glitches and be considered crass. Generally, nodes and icons are sculpted in such a way that their appearance indicates their behavior or function, i.e. an attack program looks like a rocket launcher, and so on.
HOW DO I MATRIX
To use the Matrix, you need a persona, which acts as a simsense user-interface. Personas are built into commlinks (one persona per commlink). Even if you're carring multiple commlinks, you're only using one persona to interact with the Matrix at a time. Only the Matrix Attributes (see p. XX) of the persona/commlink you are currently using matter for the purpose of Matrix actions. Carrying multiple commlinks confers no direct advantage for Matrix actions, except that you can use a cheap commlink as a disposable, less-traceable "burner" for making calls and the like. Anyway, every commlink has one built-in persona, and commlinks are everywhere.
Once you have your commlink, you need to connect to the Matrix. Your commlink connects to at least one device, which connects to at least one other device, and so on, throughout the entire world. The Matrix is all of these interconnected nodes, including yours.
Commlinks
Commlinks include a portable computer, wireless router, cell phone, PDA, GPS unit, chip reader, digital camera, wallet/credstick, and mobile gaming device, all in one pocket-sized package. Commlinks can be stylized to look like just about everything, physically. Your commlink is the central hub of your personal area network (PAN), which is all of the interconnected devices you have on your person. Cyberware, AR shades, weapons, whatever. A PAN allows you to access all of your connected electronics through your commlink. This means you can make a call, review video and image data, run cyberware diagnostics, check your vehicle's fuel gauge, program your alarm clock, IM a friend, and more through your commlink at any given time.
Digital Identity
Commlinks typically carry all of your personal data. That means your ID, SIN, licenses, passport, medical history, insurance data, educational diplomas, credit balance, and far more can be securely stored on your commlink and instantly beamed to whomever you want to send them. Many people openly broadcast certain segments of this data in their public profile, which anyone else using AR and observing them can peruse.
Most users carefully groom their digital fingerprint, but the law often requires certain core data be broadcast in certain areas (SIN must be made available on UCAS federal property and many corporate enclaves), or for certain data to be accessible by security officers who attempt to acces s it with authorized security codes.
GET REAL(ITY)
You can use the Matrix via augmented reality (information overlayed over physical reality) or virtual reality (information completely replacing physical reality). Both allow you to perform most Matrix functions with equal access.
When you have the proper hardware (see below), switching between AR, VR, and neither is a Free Action.
AUGMENTED REALITY
Most Matrix users use AR most of the time. AR is experienced as visual sight cues, icons known as augmented reality objects, or AROs. You can see AROs with an image link, which comes standard in cybereyes and smart glasses or contacts. ARO data appears as ghostly images and text in your field of view, and does not fully obstruct your field of view. You can freely open, close, and resize AR windows displayed on your HUD.
AR also has an audio compoonent, heard through an audio link in cyberears, earbud headphones, or whatever device you wish to use. You can control the volume and it is also impossible to eavesdrop on, at least with ordinary hearing. AR systems can also convey tactile information (called haptics) relayed through simsense, or by feedback gloves and clothing customized to convey temperature and pressure.
Control and manipulation of an AR interface can take place through voicce commands, AR gloves, micro-laser eye trackers in glasses, or even mental commands through direct neural interface (see below). When all else fails, the rudimentary controls on the commlink itself can be used.
Besides the obvious, intangible advantages listed above, characters using Augmented Reality can also receive the benefits of Tactical Software (p. XX).
Of course, AR can also be a drawback. If you are simultaneously holding a conference call in your head and performing a data search, you'll be a lot less likely to notice someone sneaking up behind you with a knife. The ubiquity and cleverness of corporate spam may mean you are bombarded by intrusive infomercials at the worst possible time. Finally, if someone hacks your commlink, they gain control of your sensory feed, which can be extremely harmful and unpleasant (more information about this below).
VIRTUAL REALITY
VR goes a step beyond AR in terms of intensity and immersion; you don't just perceive and use the Matrix, you enter the Matrix. In VR, your physical perceptions are completely overridden by the Matrix's sensory information.
To access full VR, you need a simrig and some form of direct neural interface. Direct nerual interface takes the form of a datajack, implanted simrig, or implanted commlink. By implanted, I mean in your brain meat. The DNI allows the simrig to communicate sensory data directly into your brain, perceived instead of reality. A simrig-DNI setup can also be used to make AR experiences more intense and immersive.
As a safety precaution, simsense overrides your body's motor functions while you are in VR, so you can't unknowingly move in the real world and potentially harm yourself or others. This means your physical body is limp and helpless while using VR, as if you were sleeping. With great difficulty, you can still perceive through your meat senses or move your physical body while in VR, but doing so is akin to doing so while stricken with cerebral palsy. If you need to move or do something in the real world, it's best to turn off VR input first.
VR is popular for intense and realistic gaming and entertainment feeds, for relatively more anonymous interactions, and because it is sparkly and pretty. It's also extremely useful for a huge number of professional applications from robotics to modeling. Most importantly, VR is fast. You move at digital speeds, faster than a street samurai, at the fraction of the cost.
The VR experience is drastically different from AR, mainly in terms of speed. You "exist" wherever your persona is within the Matrix, starting either in the node of your own commlink or one of the nodes to which you are subscribed, and from there "move" to other nodes. Physical distance is virtually meaningless within the Matrix--getting to a node on the other side of the world is practically instantaneous (but getting in is another matter entirely).
In VR, you become your persona icon. The persona firmware makes you feel like your senses and consciousness are truly embodied in your icon. Persona icons are massively customizable. You can be a two-headed dragon, a cyborg bee with implanted machine guns and a wizard hat, or look like Maria Mercurial with chrome-steel angel wings (but don't expect to sing like her without paying a premium). The point is, in VR you can become whatever you want, chummer.
While using VR, you use your Matrix Initiative rather than your physical Initiative. Matrix initiative equals your Response + Intuition + 2, and you receive two extra Initiative Passes (for a total of three). You also receive a +1 dice pool bonus to all Matrix tests while using VR.
While faster, VR is also more dangerous. However, VR makes you vulnerable to the lethal and brain-damaging aspects of Black IC (p. XX). The rush of full VR can also be addictive.
Sometimes, wage slaves and corporate terminal-surfing deckers use a biofeedback limiter incorporated in their simrig when using VR; this protects them from the lethal effects of biofeedback, but limits the advantages of VR. When using a limiter, a Matrix user receives -2 to Initiative and -1 Initiative pass, but is completely protected from the lethal effects of intrusion countermeasures. See p. XX.
Any action taken in the physical world while in VR suffers a -6 dice pool penalty.
Zones
While the wireless Matrix is available in most of the world, there are places abandoned to decay, poverty, and crime where access might not be universal. These areas are known as static zones, where access is intermittent or unreliable, and dead zones, where no wireless Matrix access is available. The inverse of this would be spam zones, areas over-saturated with manipulative viral advertising tricks like filter-bypassing, sensory-blasting AR pop-ups, emotive-charged simsense feeds (especially porn), spyware, and more. These too make Matrix actions difficult.
STATIC AND DEAD ZONES
Dead zone
No wireless connection possible without satellite uplink.
Spam zone
-1 to -3 to all actions
Static zone
-1 to -3 to Matrix actions
HARDWARE
The Matrix exists on a series of devices. A device in this case is defined as any hardware with Matrix connectivity enabled, whether wired or wireless. A device can be a peripheral device (anything but a commlink or a nexus), a commlink (discussed earlier) or a nexus (nexi are mainframe supercomputers that host multiple personae and many programs simultaneously; they aren't seen out and about, and are usually sequestered in secure corporate facilities: they may even be isolated from the wireless network).
MATRIX ATTRIBUTES
Devices have Matrix attributes: Firewall, Response, Signal, and System.
Firewall is the device's built-in security software. It protects against unauthorized access and fends off hostile access attempts and exploits. Firewall is also used to defend against Matrix attacks in cybercombat (p. XX).
Response is the processing power and speed of the device's hardware. Respoinse is used for Matrix Initiative and is negatively affected when you run too many programs.
Signal represents the broadcasting power of the device's hardware. The higher the Signal, the farther the device can transmit. Signal ranges and examples are listed on the Signal Rating Table. When two devices are within the range of the lowest Signal rating of the two, they are said to be in handshake range (mutual Signal range). This is required for direct device-to-device communication, but not for communications routed through the Matrix.
System measures the power of the device's operating system. System limits the number of programs running on the device, and sets the limit on most devices for the number of programs that can be run without a Response drop. System also sets the size of the Matrix Condition Monitor of persona programs running on the device (Cybercombat, p. XX).
Program Load measures the number of programs a commlink can have loaded and active at one time. It is equal to System x 2. Program Load is described in more detail under Software, p. XX.
Device Rating is a universal rating used for miscellaneous electronic devices. Each of an electronic device's Matrix attributes equals its base Device Rating. Important devices should be assigned a full complement of Matrix attributes.
The Sample Devices Table lists typical Device ratings.
SIGNAL RATING TABLE
Signal Rating Signal Range Examples 0 5 m Nanoware transceivers, cyberware, intra-PAN devices 1 50 m RFID tags, handheld electronics 2 100 m Headware transceivers, micro-drone sensors 3 500 m Average commlinks, residential/small business wi-fi routers, vehicular autonav sensors 4 1 km Crawler-drone sensors 5 5 km Cyberlimb transceivers, heavy drone surveillance sensors 6 10 km Cell-phone towers, public access wi-fi routers 7 50 km Targeting sensors for ground vehicle weapons (ATGMs, etc.) 8 100 km Flight radar, dedicated ground surveillance radar 9 500 km Maritime/naval radar, commercial AM/FM radio
SAMPLE DEVICES TABLE
Device Type Device Rating Examples Dumb 1 Household appliances Simple 2 Public terminals, entertainment systems Average 3 Standard personal electronics, vehicles, drones, home/business terminals, basic cyberware Complex 4 Security vehicles, alphaware, security devices, headware Smart 5 Research terminals, high-end devices, betaware, security terminals Advanced 6 Deltaware, credsticks, military drones Sophisticated 7 Military vehicles, high-security corporate hosts Miltech 8 Military command/control satellites, air traffic control radar Bleeding Edge 9+ Ultraviolet Hosts, Zurich Orbital, Places-You-Shouldn't-Go/Shit-You-Shouldn't-Fuck-With
OFF-THE-SHELF COMMLINKS & OPERATING SYSTEMS
Commlink Descriptor Response Signal Example Brand Names Cost Low-End 1 2 Meta-Link, CMT Clip, Sony Emperor 250¥ Decent 2 3 Renraku Sensei, Novatech Airware, Erika Elite 1,250¥ Deluxe 3 4 Hermes Ikon, Transys Avalon, Fairlight Caliban 5,000¥
OS Descriptor Firewall System Example Brand Names Cost Low-End 1 2 Vector Xim, Redcap Nix 200¥ Decent 2 3 Renraku Ichi, Mangadyne Deva 800¥ Deluxe 3 4 Iris Orb, Novatech Navi 1,500¥
Off-The-Shelf Commlinks
Commlinks can be used out of the box, and many of the net's commoners do just that. For hackers, however, the brand name on the cover plate is meaningless. What really matters is the electronic guts and the software soul inside, the hardware and OS components you've tinkered with and customized to make the ultimate Matrix crime platform.
Starting Customizations
Hacker characters (in other words, any characters that have spent BP on skills in the Cracking and Electronics skill groups) can begin gameplay with one commlink already custom-tuned. That commlink's Response and Signal are equal to the character's base Hardware skill, and its Firewall and System are equal to the character's base Software skill.
(Once a commlink has been customized, whether it's in the case of a shitty CMT Clip or a dope Fairlight Caliban only matters for reasons of flash value and social prestige.)
Upgrading Devices
Upgrading a device costs nuyen and takes time. Each of a device's Matrix Attributes can be upgraded. The nuyen it costs to upgrade a device is equal to the new attribute times 1,000¥. Increasing a device's Response from 1 to 5 costs 5,000¥, while increasing a device's firewall from 3 to 4 costs 4,000¥.
The maximum rating of an upgraded Matrix Attribute is equal to the upgrading character's Hardware skill (for Response and Signal), or Software skill (for Firewall and System), to a maximum of 10.
Upgrading a device's Response or Signal requires an extended Logic + Hardware test with a threshold equal to the new rating x 2 and an interval of one day. Upgrading a device's Firewall or System requires an extended Logic + Software test with a threshold equal to the new rating x 2 and an interval of one day. If a glitch is rolled at any point during the upgrade test, the resources (code modules or hardware components) being used are lost or exhausted, and the nuyen for the upgrade must be spent again. If a critical glitch is rolled, the device may be permanently damaged or even destroyed (GM's discretion), and to make matters worse, you almost certainly voided the warranty.
DEVICE MODES
Devices can run in one of three modes: Active, Passive, and Hidden. (This is distinct from the three means of accessing Matrix data with your brain: AR, "hot" VR and limited VR, discussed earlier.) Anyone can change the mode of their commlink as a Free Action.
Active mode is the default for most PANs. In active mode your PAN can both access and be accessed by other devices and networks. Certain areas may require your PAN to be in active mode, like airports, corp facilities, major metropoloitan centers, etc. Your public profile is visible and available (although of course the information there might be counterfeit.)
A PAN in Passive mode can be seen by other devices, but cannot be accessed by them without your approval. PANs in this mode will still show up as active networks. This mode is useful for operating in high-traffic areas which are littered with advertising spam.
In Hidden mode, your commlink/PAN are invisible to other nodes unless you access or authorize them. Users in hidden mode are said to be "ghosting", since there is no way for other users to see them wirelessly. Certain secure and high-class establishments prohibit users from activating in hidden mode, and will punish those doing so with expulsion, arrest, or worse. In other areas, such as tech-free zones and shadowy establishments, the opposite may true, with hidden mode the norm. Sometimes you will be dealing with people who don't know you and who don't want to know you.
SOFTWARE
In order to do Matrix things on the Matrix, you need to use programs. Programs are to a hacker what spells are to a mage, and function in a similar way. You can buy programs, or write them yourself; programs are then loaded onto a persona or agent. There is no limit to the number of programs that may be loaded into a persona or agent.
In order to use a program, it must be running. Having a program loaded is like having a gun in your coat pocket; having a program running is like having the same gun drawn. A running program is executed by the device your persona is running and belongs to your persona; like the above gun example, only you may use the program.
Most programs don't have ratings, they simply enable a specific Matrix action or functionality if they are running; if they are not running, that Matrix action is impossible. Some programs do have ratings, however: these ratings function in a manner roughly analogous to the Force of a mage's spells, although the Rating of a program doesn't change on the fly in the same way the Force of a spell might. A program with a rating operates at its own rating or the System of the device, whichever is lower.
Running programs count against the device's processor limit.
Processor Limit Rules
For every (System x 2) programs running on a device (including agents), the device's Response rating is temporarily reduced by two. For example, a Commlink with System 4 and Response 5 would have a Response of 5 if it was running 7 or less programs, a Response of 3 if it was running between 8 and 15 programs, and a Response of 1 if it was running 16 or more programs. If a commlink's Response is reduced to 0, it is so laggy that it is effectively inoperable.
You may only use one program of each type at a time. For example, if you have an Armor 3 and an Armor 5 program running, you may only use one of them to resist Matrix Damage.
The following list describes most of the programs available in Shadowrun. Programs that have ratings will have the range of possible ratings listed next to their names.
COMMON PROGRAMS
Common programs are widespread and legal throughout the Matrix.
Analyze
A running Analyze program provide a +4 dice pool bonus on Matrix Perception tests (p. XX) targeting a single icon or node. Using the Analyze program usually involves a Computer + Intuition roll.
Browse
A Browse program is the basic prerequisite for performing Data Searches (see p. XX) and is one of the most ubiquitous programs among all Matrix users, from basic everyday users to elite hackers. Using the Browse program usually involves a Data Search + Intuition roll.
Command
A Command program is necessary to remotely control devices through the matrix using the Issue Command (p. XX) and Control Device actions (p. XX). The Command program only sends orders to devices, it does not convince devices to accept those orders. For that, you need to hack the device with an Exploit program, or to trick the device with a Spoof program.
Edit
Edit is a combination word processor, graphic design tool, and video/animation editor, as well as an advanced end user interface for a dynamic file transfer protocol. It is the only Matrix program more ubiquitous than Browse. It is needed to initiate and terminate data transfers, and to perform the Edit action (p. XX). Virtually every device is, at a minimum, running Browse and Edit at all times. Using the Edit program usually involves a Computer + Logic test.
Encrypt (Rating 1 - 6)
Encryption programs utilize various cryptographic schemes and ciphers to secure files, nodes, and communications. An Encrypt program allows the use of the Encrypt action (p. XX).
Scanner
A scanner program allows you to locate wireless networks, whether they are hidden or sitting in plain sight. It is necessary to perform the Detect Wireless Node (p. XX) and Detect Hidden Node (p. XX) actions. Using Scanner to Detect Wireless Nodes does not require rolling dice, but using Scanner to Detect Hidden Nodes involves an Electronic Warfare + Logic Test.
HACKING PROGRAMS
The following programs are generally used only by hackers and their opposite number, security specialists and IC. In most jurisdictions, they are illegal without the proper digital paperwork.
Armor (Rating 1 - 10)
Armor programs protect icons and devices from attacks that cause Matrix damage (p. XX).
Attack (Rating 1 - 6)
Attack programs are hostile code carriers that seek to crash an icon. They are used in Cybercombat (p. XX), where they inflict Matrix Damage on personas.
Biofeedback Filter (Rating 1 - 6)
Biofeedback filters are software routines that monitor simsense signals and filter harmful feedback. They are designed specifically to defend against Black IC (p. XX), dumpshock (p. XX), and Matrix attack programs that attempt to harm/damage the brain directly (p. XX).
Black Hammer (Rating 1 - 6)
Black Hammer is a Matrix attack program that injects dangerous biofeedback responses into the target's simsense interface; it is generally associated with Black IC, and has only recently seen use by humanoid hackers. These aggravated signals may overload the target's neural connections and in turn render him unconscious, or cause death from stroke, heart failure, respiratory paralysis, aneurysm-- the list goes on. Black Hammer is used within Cybercombat (p. XX).
Black Hammer causes physical damage against hackers in full VR; against VR users that are using a limiter, it only inflicts Stun damage. It has no effect on programs, agents, IC, sprites, or AR users.
Blackout (Rating 1 - 6)
Blackout is a non-lethal version of Black Hammer, also designed for use in Cybercombat (p. XX). It causes Stun damage to full VR users with and without limiters. It has no effect on programs, agents, IC, sprites, or AR users.
DECRYPT
Decrypt programs are designed to perform sophisticated mathematical tricks to break into encrypted files. A Decrypt program is necessary to use the Initiate Cryptanalysis matrix action (p. XX). Using a Decrypt program usually involves an extended Electronic Warfare + Logic test.
ECCM (Rating 1 - 6)
Electronic counter-countermeasures filter out jamming signals that attempt to disrupt a wireless connection. An ECCM program adds its rating to the Signal rating of the device it's running on when defending against the Smoke program (p. XX).
Exploit
An Exploit program is the basic tool needed to gain unauthorized access to nodes that don't want you mucking about in them. Of course, the Exploit program on its own doesn't do all the work, it just makes things possible for hackers with enough moxy, wit, skill, and determination. An Exploit program enables the crucial Hack Account Access matrix action (p. XX). It is usually used with a Hacking + Logic Test.
Homewrecker
Homewrecker is a program that wreaks large-scale havoc on a node's system infrastructure and code base. It is needed to perform the Crash Node matrix action. Using Homewrecker usually involves a Hacking + Logic Extended Test.
Medic (Rating 1 - 6)
A Medic program is used to repair Matrix damage inflicted on icons and devices. The Medic program is necessary to perform the Repair Icon matrix action (p. XX). Using Medic usually involves a Computer + Logic Test.
Mirrors (Rating 1 - 6)
A Mirrors program makes a hacker more difficult to target and hit in Cybercombat (p. XX).
Smoke (Rating 1 - 6)
A Smoke program serves two basic functions. One is to jam ALL wireless devices within handshake range that aren't on a list of excluded devices. The other is to inflict penalties on Matrix Attack and Matrix Perception rolls by all icons within a specific node (including yourself and allies). The Smoke program is therefore necessary to initiate the Pop Smoke (p. XX) or Jam Signals (p. XX) matrix actions. Activating a Smoke program for either application never involves rolling dice.
Sniffer
Sniffer programs gather data traffic and wireless signals and capture the information, making them the ultrimate Matrix spying utility. A Sniffer program is required to initiate the Capture Wireless Signal matrix action (p. XX). Using a Sniffer program usually involves an Electronic Warfare + Intuition Test.
Sparky (Rating 1 - 6)
A Sparky program allows a hacker to quickly and efficiently Force dangerous code into a nearby wireless device without going to the trouble of hacking all the way in with an Exploit program.
A Sparky program is necessary for the Brick Device matrix action (p. XX). Using a Sparky program usually involves a Hacking + Logic Test.
Spoof
Spoof programs generate false access IDs and forge misleading data packets. A Spoof program is necessary to attempt the Redirect Trace (p. XX) and Spoof Command (p. XX) Matrix Actions. Using a Spoof program usually involves a Hacking + Logic Test.
Track
Track progams analyze a user's connection and follow the datatrail back to the originating node/device. A Track program is needed to perform the Trace User matrix action (p. XX). Using a Track program usually involves a Computer + Logic Extended Test.
AGENTS AND IC
Agents are semi-autonomous programs capable of using other programs. Marix users employ agents as basic data-processing and search assistants, while hackers use them as drones and weapon platforms.
Agents have a Pilot attribute that determines how "smart" the agent is. The Pilot attribute acts as the agent's System and Firewall attributes, as well as its Computer, Cybercombat, Data Search, and Hacking skill ratings.
Agents use the Response attribute of the node on which they are running. This means that the attributes of an agent operating independently may vary as it moves from node to node.
Agents can be loaded and run like other programs, using a Complex Action to run the agent. The agent is a running program and counts against a node's processor limit. If you run the agent in the same node in which your persona resides (i.e. your commlink), it can assist you in any nodes you access. You must have an account with permission to run the programs on the node (usually security or admin).
Agents can also access other nodes independently if instructed to do so. They must have access to the node either by using your account or hacking their own. When operating independently, an agent has its own icon. Agents may not have icons in multiple nodes like persona programs can. Traces on an agent program trace back to your own point of origin.
An agent on your node counts against your device's processor limit, but not your subscription limit. An agent operating independently counts towards your subscription limit, but not your processor limit. The guidelines for issuing commands to agents are the same as those for issuing commands to drones.
Payload
You can load copies of your programs into your agent so that it can run them on its own. Your Agent can only run (Rating x 2) programs at any one time, so choose its loadout carefully. The Deactivate Program Simple Action allows you to remove one of the programs you own from an agent's running payload; the Run Program Complex Action allows you to add a new program you own to an agent's running payload.
Intrusion Countermeasures (IC)
Intrusion Countermeasures are essentially specialized agent programs used to defend systems. IC programs are equivalent to agents and function the same way. IC programs are typically loaded with some of the more offensive programs to employ against intruders, like Attack, Black Hammer, or Blackout, as well as Analyze, Armor, or Track. IC has the same limits on the number of programs it can run as any other agent, and each IC agent running counts against the node's processor limit.
Some nodes will launch an IC program when an alert is triggered and direct it to engage any intruders. Once launched, IC programs act independently of each other and the node: each has its own icon and its own initiative. At other times, IC are actively patrolling a node that is not on alert, Analyzing icons at random.
More proactive IC programs may be loaded with additional utilities such as Exploit or Stealth and may actively pursue intruders if they leave the node or even track the intruder back to her originating node and attack her there. IC programs are typically loaded with any necessary passcodes they may need to access any connected systems.
Sample IC appear on p. XX.
MATRIX PERCEPTION
When you make a Matrix Perception test (a Simple Action), you roll Computer + Intuition rather than Perception + Intuition. Obviously, to make a Matrix Perception test you must be perceiving the Matrix either through AR or VR. A Matrix Perception test will give you at least basic information (and perhaps more, based on your hits rolled) about all icons you are interacting with, all nodes you are subscribed to, all icons in nodes you are subscribed to, and all icons and nodes within handshake range (see Signal, p. XX).
You can also make a Matrix Perception test targeted on any particular node or icon to glean more information about it, for instance scanning a node on the Matrix you intend to hack into, but are not yet subscribed to. For each hit scored, you can ask for one piece of information about the object, such as its rating, alert status, or any other pertinent information from the following list:
- Alert status of node
- Last edit date of a file
- Function of a control icon
- Hidden access to another node
- Matrix damage taken by icon
- Programs run by persona or agent
- Rating of one Matrix attribute
- Type (file, user, agent, program type, etc.)
- Whether a file or node is encrypted
- Whether a trace is running
The default assumption is that a single Matrix Perception test lets you determine the presence and type of all icons and nodes within handshake range or within nodes you are subscribed to. There are two exceptions to this.
One exception is nodes or icons set to run in hidden mode (see p. XX), which require a different action and procedure to detect (see p. XX). They won't show up on a standard Matrix Perception Test at all.
The other exception is any target running a Stealth program. The Matrix Perception becomes an Opposed Test, with the target rolling Hacking + Logic as the opposing dice pool. The hits from this test reduce your hits, and the amount of information you can garner. If you achieve no net hits, the target escapes your notice entirely. (It will sometimes be appropriate for the GM to make your Matrix Perception test and the target's Hacking + Logic test in secret, such as in situations where the player has no reason to expect a Stealthed icon is present.)
MATRIX ACTIONS
The following actions can be performed by users in AR or VR. Many Matrix actions require the use of a running program listed in parentheses with the action in order to be initiated.
FREE ACTIONS
Change Linked Device Mode
You change the mode of a Matrix device that is linked to your commlink/persona. Mode changes include weapon firing modes, on/off status, active/passive/hidden status, and so on.
Detect Active/Passive Wireless Nodes (Scanner)
With this Free Action, you automatically find all of the nodes within Signal range that are in Active or Passive mode. You also get a rough idea of the position of corresponding devices in the physical world.
Jack Out
You disconnect from your persona. In AR this just means shutting down your interface, but in VR it means rapidly "pulling the plug" of your neural connection, in whatever form that takes. If you jack out while in VR, you suffer dumpshock (p. XX). Jacking out requires a Complex Action and a successful test if your connection is jammed open by a black IC program (p. XX).
Switch Interface Mode
You switch your perception from VR to AR or vice versa. Note that switching to VR causes your body to go limp, so do not do it, for instance, on top of a moving monorail car. If you switch from VR to AR, you might lose one or more Initiative Passes. If your connection is jammed open by black IC, switching interface modes is impossible.
Terminate Data Transfer (Edit)
You terminate any data transfer you have initiated, or that you have the correct permissions to terminate.
Transmit Phrase
You speak or text a phrase to one or more recipients over the Matrix. This can also be used to have an agent or device start or stop executing previously issued orders.
SIMPLE ACTIONS
Analyze Icon/Node
You make a Matrix Perception Test targeting a specific node or icon. This action is described in detail above, under Matrix Perception.
Brick Device (Sparky)
You attempt to damage or destroy any wireless electronic device within handshake range, inflicting Matrix damage on it. This device can be anything from a toaster to a security camera to a smartlinked firearm to a wireless-enabled piece of cyberware, as long as it's within handshake range and operating with a wireless connection. You cannot attempt to Brick a Device you are accessing through an indirect (Matrix) connection using this action.
Roll Hacking + Logic versus the device's Firewall (usually its Device Rating) + Armor, if the device is running an Armor program. If you succeed, you deal a number of boxes of Matrix damage to the device equal to your Sparky Program Rating plus your net hits. If you inflict enough Matrix damage on the device to incur wound penalties, appropriate actions using the dice suffer the corresponding dice pool penalty.If you fill all 12 boxes of the device's Matrix Condition Monitor, the device is "bricked", becoming useless until repaired and rebooted.
The degree to which the device becomes unusable depends upon its dependence on wireless functionality. A security camera or a commlink would be bricked entirely; a handgun with a smartlink and a wireless safety mechanism might become entirely un-fireable until rebooted, while a Streetline Special with no wireless features would be unaffected; smart contacts, glasses, or goggles could be entirely wrecked, but could then just be discarded; cybereyes or cyberlimbs could be shut down entirely by being bricked, but bricking someone's wireless-capable wired reflexes would probably only deny them the extra Initiative Passes and Reaction bonus, rather than causing their entire nervous system to seize (at the GM's discretion).
Deactivate Program
You switch a program's status from running to loaded. This action may also be used on an agent, in which case all of its running programs also stop running.
Decrypt With Key (Special)
If you have the key to a particular encryption, you decrypt it with this action.
Encrypt (Encrypt)
You encrypt a file, set of files, node, or communication link. You also choose a passcode that your or another user can use to decrypt the file. You may encrypt multiple files together into a single archive file. The encrypted file's encryption threshold is equal to your Encrypt program rating times your Computer skill. A file, node, or what-have-you can only be encrypted once.
Issue Command (Command)
You give a short list of commands to an agent, drone, or device that accepts your access ID as authorized to do so (p. XX). You may send the list of commands to multiple recipients, but it must be the same list of commands; different commands require the use of another Simple Action.
Jump Into A Drone/Vehicle/Device
You jump into a drone, vehicle, or device in VR. This action is described in detail under Jumping In, p. XX.
Graceful Log Off
Your personal logs off of a node, severing the subscription and connection to that node or you may use this action to disconnect from your persona while in VR, avoiding dumpshock. This action does not, in and of itself, erase access logs. Black IC programs are capable of preventing you from logging off gracefully (see p. XX).
Observe In Detail
You make a Matrix Perception Test that returns basic information on all icons in every node you are connected to, and all nodes and icons within handshake range. This action is described in detail above, under Matrix Perception.
Pop Smoke (Smoke)
You activate a Smoke program, clouding a node with junk data that makes all Matrix Perception and Matrix Attack actions less effective for all users in the node, yourself included. A dice pool penalty equal to the Smoke program's rating is applied to all Matrix Perception and Matrix Attack actions within the node for as long as the Smoke program is running.
Transfer Data (Edit)
You transfer a file or set of files from one node to another. Most transfers last until the end of the current Combat Turn; the connection speeds of the Matrix are fast enough that only files of truly epic size take longer than normal.
COMPLEX ACTIONS
Capture Wireless Signal (Sniffer)
You eavesdrop on wireless traffic going to and from a device. You must be within the device's Signal range to capture the traffic. You must succeed in an Electronic Warfare + Intuition (3) test to start the capture, and then you may copy, record, or forward the traffic without another test as long as you remain within the target device's Signal range and keep the Sniffer program running. There is no other way for other parties to detect your capture (without access to your commlink, of course) unless you roll a glitch when initiating the capture. You can capture traffic from up to (System) sources at one time, but the captures must be initiated separately.
Control Device (Command)
You control a subscribed device through the Matrix, using your Command program like a remote control. The dice pool of any test you make using this action uses the rating of your Computer skill in place of the attribute you would use along with the appropriate skill as normal. For example, firing a drone mounted launcher at a target would require a Heavy Weapons + Computer test.
Note that if the action to be performed is normally a Simple Action, performing it remotely with the Command program is still a Complex Action.
Crash Node (Homewrecker)
You crash a node that your icon is currently accessing. Make a Hacking + Logic (System + Firewall, Complex Action) Extended Test. When you reach the threshold, the node is crashed and will begin to reboot (p. XX). The node issues a restricted alert against the attacker when you first begin attempting to crash it, granting it a +4 bonus to Firewall among other effects listed on p. XX. All users accessing the node via VR must resist Dumpshock when the node crashes, including the hacker.
Data Search (Browse)
You search the Matrix for information about a topic. This is a Data Search + Intuition Extended Test with a variable threshold and interval, depending on the general availability of the information in question and the "area" being searched, respectively.
Some information is protected and kept secret, stored in an offline node, and so cannot be found without accessing the node on which the data is hidden, although a Data Search might be made to find the location of the information.
Detect Hidden Node (Scanner)
You attempt to locate a hidden node that you have some suspicion is there. To find the node, make an Electronic Warfare + Logic (3) test. Alternatively, you may instead make a general search for Hidden nodes that are within handshake range; in this case, the test is Electronic Warfare + Intuition (5) test. Success reveals all Hidden nodes within handshake range.
Edit (Edit)
Edit allows you to create, change, or delete any kind of file. A Complex Action is required to alter one detail of a file, about (Computer Skill) sentences of text or details of an image or seconds of video or audio (gamemaster's discretion). Making convincing edits and/or digital forgeries requires a successfl Computer + Logic Test with a threshold set by the gamemaster. Continuous editing of a device's output requires the expenditure of a Simple Action every Initiative Phase for the duration.
Hack Account Access (Exploit)
This is the basic first step in all virtually all Matrix hacks. You attempt to create an account for yourself an a target node. This is a Hacking + Logic (target's Firewall, Complex Action) Extended Test. When you reach the threshold, you gain an account on the target node. This process is described in substantially more detail in Actually Hacking The God Damn Matrix, p. XX.
Initiate Cryptanalysis (Decrypt)
You have your Decrypt program start working on an encryption to which you have access. Cryptanalysis is an Electronic Warfare + Logic test with an interval of 1 Combat Turn, 1 Minute, or 1 Hour, depending on the size of the file (GM's discretion). The threshold for this test is equal to the rating of the Encrypt program used times the Computer skill of the encrypting character. In situations where the Computer skill of the encrypting character is unknown, the threshold is equal to 3 times the rating of the Encrypt program used. When you break the encryption of a file, the file becomes decrypted. When you use this on a node, you may access that node, but it remains encrypted to others.
Once you have initiated crypto, your Decrypt program takes over and runs autonomously, using your Electronic Warfare skill rating and Logic attribute as described above. Each running Decrypt program can only work on one encryption at a time.
Jam Signals (Smoke)
You start a jamming program. You may choose any number of known devices to be excluded from the jamming when you initiate the jamming, and may change the list with another Jam Signals action. When the jammer is activated, every device within handshake range with a Signal rating less than the rating of the Smoke program becomes jammed and loses wireless connectivity. Note that a device running an ECCM program adds the rating of that program to its Signal for the purposes of countering jamming.
Log On
You open a subscription to a node, and your icon appears there. The node must be one you have access to (either legitimate or hacked) for this action to work. You also needs a connection to the node's device, either wired or wireless.
Matrix Attack (Various Programs)
This action is described in detail in Cybercombat (p. XX).
Reboot
You initiate a reboot of a device with a Complex Action. You must have the appropriate privileges to do so (and usually that means an admin account). To reboot a device, you must make a System + Response (10, 1 Combat Turn) Extended Test. When enough hits are achieved, all programs stop running and all subscriptions are terminated, and anyone who is still running their persona on the device is severed from the Matrix, suffering dumpshock (p. XX) if they are in VR. Restarting the system then takes a number of Combat Turns equal to the device's System, at which point the device comes back online and its node reappears in the Matrix.
Redirect Trace (Spoof)
You muddle your active datatrail against an active tracking attempt, making it harder for a running Track program to find your persona's node. Roll Hacking + Logic: the number of net hits from this test are added to the threshold that the tracking icon needs. You may take this action multiple times against the same target. This action only works against a tracking attempt in progress.
Repair Icon (Medic)
You heal the Matrix Damage that a persona, agent, or IC icon has suffered. Make a Computer + Logic Test. A number of damage is removed from the target equal to your hits plus the Medic program rating. This action only repairs Matrix Damage.
Run Program
You change a loaded program's status from loaded to running. Programs must be running in order to be used.
Spoof Command (Spoof)
You send a command to a device or an agent, pretending it is from an authorized source. You must have succeeded a Matrix Perception Test on the authorized source while running an Analyze program in order to spoof orders from that source. To spoof a target, choose a command (per the Issue Command action, p. XX) and make an Opposed Test between your Hacking + Logic and the target's Pilot + Firewall (or System + Firewall if the target does not have a Pilot attribute); if you succeed, the target accepts the command as legitimate. Each Spoof Command action applies only to a single command; multiple commands require multiple Spoof Command attempts.
Trace User (Tracker)
You trace an icon back to its originating node. This is a Computer + Logic (10, Complex Action) Extended Test. The target may increase the threshold with the Redirect Trace action, and a Stealth program run by your target acts as a negative dice pool modifier.
When you reach the threshold of the Extended Test, you have successfully traced the target, learning the location of the device housing the originating node (usually the user's commlink).
If the target is using a wired connection to the Matrix, you have his exact location; if the target is using a wireless connection, you have his location triangulated to within about 50 meters. As long as you keep your Track program running and the target remains connected to the Matrix, you may continue to monitor the target's location.
You can also use this action to trace a subscription to its other end. For example, you may trace the subscription from a drone to the rigger controlling it.
NODES
A node is a virtual space in the Matrix. Every device in the physical world projects a node in the Matrix as long as it's active. If icons are the "what" in the Matrix, nodes are the "where". Nodes appear in VR as places. When you first enter VR, your icon starts in your commlink's node, which contains icons for everything in your PAN. Nodes are "sculpted" with a virtual appearance and virtual physics. This is usually, but not always, reflective of and appropriate to the node's function.
ACCESSING NODES (LEGITIMATELY)
While online, you can access one or more nodes. Much of the time, you just send a message to the node for some data, and the node sends it back to you. If you want to actually visit the node in the Matrix, you need to log on to the node. You can only log on to a node within handshake range (see Signal, p. XX) while using AR. While using VR, you can (attempt to) log on to a node anywhere in the world.)
Subscriptions
To connect to a node, you must subscribe to it. Subscribing to a node is a Complex Action (Log On, p. XX). You can have more than one subscription open at a time. Each personal is limited to a number of subscriptions equal to twice its System (i.e. a persona on a System 4 commlink could have up to eight active subscriptions at a time). You don't need to subscribe to the node in which your persona is running (i.e. your commlink), and it does not count against your limit.
Multiple Subscriptions
As noted above, it is possible to be subscribed to multiple nodes at once. This means you can have icons in multiple places in the Matrix at any given time. You are aware of what is happening in all nodes in which your icon exists. You may only control one icon at a time, but may switch which is the "acting" icon at will. For how this multi-presence effects cybercombat, see p. XX.
Access Accounts
When you log on to a node, you do so at a certain access level. There are four types of accounts: public, user, security, and admin. Except for public accounts, access to an account level requires authorization (see below).
A public account requires no authorization, and functions as a kind of foyer. Public accounts allow only access to public information, and an extremely basic amount of functionality. Most retail outlets, malls, restaurants, and anything else open to the public offers a public account option, while secure nodes and devices obviously do not.
A user account is offered to basic users who belong in the node, whether paid customers of a Matrix bar or the rank-and-file employees of a corporate office. Icons with this level of account access can run programs, create and edit files, and perform other tasks appropriate to the function of the node. User accounts require authentication to access.
A security account is for users who are responsible for safeguarding the node's data. These users are allowed the privileges of user access, plus the ability to delete files, run IC, log off users, and initiate alerts (and sometimes shut down alerts as well, depending on the node's security protocols).
An admin account is "god-level" access. No action or command is denied to an admin account. Most nodes only offer this account to a few users, or only one.
Authorization And Authentication
There are a number of methods a node can employ to authenticate users.
A node could demand a basic passcode before permitting entry. Basic passcodes consist of sets of symbols that are entered to log on to a node. The most common passcodes are alphanumeric strings, but thanks to the prevalence of AR and VR, "symbols" can also consist of images, tones, or even specific movements.
If this is not secure enough, a linked passcode requires an extra bit of input from the user specific to a person or device. This passcode is linked to something the user or his commlink uniquely possesses. This can be a security scan (retina, fingerprint, palm print, or so on) or the correct signature from a device's unique RFID tag. If the scan or signature doesn't amtch the records, access will be denied.
Passkeys are one of the most secure ways of controlling access to a node. Passkeys are unique encrypted modules that plug into a commlink or terminal. Many corporations require this accessory for telecommuting workers. When a user attempts to log on to the node, it queries the module. If it does not receive the proper code, the user is denied access.
ACTUALLY HACKING THE GOD DAMN MATRIX
The easiest way to get access to node is to have permission; of course, it doesn't have to be your permission. There are dozens of social engineering tricks, and of course outright thievery, that could net you the passcodes, passkeys, or other authorization from legitimate users of the node. But much of the time, a hacker is at a loss for a certified way into a node, and must resort to hacking.
The goal of hacking a node is to create your own account on the target node. In order to hack a node, you must either be within handshake range of the target node's device or have an open subscription with the node through the Matrix.
There are two ways to hack a node. Speed hacking is quick, but messy; there's a high risk of detection. Cautious hacking takes much longer, but also is more likely to go quiet and smooth.
SPEED HACKING
Speed hacking is a Hacking + Logic (target's Firewall, Complex Action) Extended Test. Reaching the threshold will get you a user account; for a security account, increase the threshold by +3; for an admin account, increase it by +6. When you beat the threshold and gain the account, you are logged onto the node with that level of access.
Brute-forcing your way into a node this quickly is not quiet. Each time you take a Speed Hacking action, the target node makes a free roll on a System + Firewall (hacker's Stealth) Extended Test. If the node detects you an alert is triggered, even if you have succeeded in your attempt (Alerts, p. XX).
Example: Orphan and his team just shot their way out of a meet gone bad. Things got hosed up real ugly, and they've lost their transport. They need new transport, and fast. Orphan is crouched in an alleyway within view of an SUV across the street. He needs to make that SUV his, and speed is key, so he starts a Speed Hack. He needs Security Access--the only level of access the car offers--to unlock the doors and get the process of stealing the car started. The gamemaster adds three to the threshold (which is 3, the car's Device Rating). Orphan rolls his Hacking of 5 + Logic of 5 for a total dice pool of 10. He rolls and gets 3 hits, he's not in yet, only about halfway there. In response, the node rolls its System 3 + Firewall 3 (in other words, Device Rating x 2), getting 2 hits; not enough to reach Orphan's Stealth rating of 5.
In his next action phase, Orphan continues his hack, rolling and getting 4 hits this time; more than enough for a Security Level account. He's logged on to the node with a shiny new security account.
The node gets one last chance to detect his intrusion, though. It rolls and gets 4 hits, bad luck for Orphan. The node is now on alert when he gains access, and will follow whatever alert protocols have been set for it (see p. XX).
CAUTIOUS HACKING
If you have the time to properly case your target, your hacking attempt is more likely to go unnoticed. Using this method, you discretely probe your target over an extended time frame, identifying system flaws that can be exploited for access.
Probing is a Hacking + Logic Extended Test with a threshold equal to the target's System + Firewall. The interval of the test is 1 hour, and you must be in VR to perform Cautious Hacking. Once you reach the threshold, you have found a crack in the system's defenses that you can exploit to gain access. You do not automatically gain access; you have found the chink in the armor, but have not used it yet. These exploits do not remain forever, and can be removed if found by the node's security or if the node is rebooted. The GM should secretly roll your Hacking + Logic vs. the node's System + Firewall. Your window is open for 12 hours per net hit you achieve, to a minimum of 12 hours. But the GM does not reveal your window's duration to you.
As long as your window is still open, you may use a Log On action to use your hacked account. This process grants you a user account. If you want a security account, increase the threshold by +3. If you want an admin account, increase it by +6.
The target node gets one free System + Firewall (hacker's Stealth) Test when you first log on with the hacked account. If the node detects you, an alert is triggered (Alerts, p. XX).
Example: Chrome Sally's team is planning an extraction of a researcher from a Shiawase Atomics facility, and they're counting on her to perform some Matrix reconaissance beforehand. She wants a map of the facility at a minimum to plan the op, but having a backdoor for later, to take control over doors and alarms and run Matrix Overwatch, would be even more useful. The facility's site is connected to the Matrix with a Public foyer, but for this, she'll need to hack a Security Level Account.
She rolls her Hacking 5 + Logic 6 and and gets 4 successes. The node's System 5 + Firewall 4 is 9, so she's a third of the way in including the +3 for Security Access. It takes two more rolls, and two more hours, for her to reach the threshold of 12 and gain access. She decides to use her hacked access right away so she can download the map the team needs. At that moment, the target node rolls its System + Firewall (9 dice) and gets three successes, not enough to equal Sally's Stealth of 5. Sally gains access to the system with no alert. So far, so good.
The GM secretly rolls Sally's Hacking + Logic (11 dice) versus the node's System + Firewall (9 dice), getting two net hits for Sally. This Security Level Account exploit will remain open to Sally for 24 hours, unless her tampering causes an alert, in which case all bets are off. If the team happens to make their infiltration within those 24 hours, Sally will have access to perform Matrix overwatch, barring patrolling IC, nosy deckers, and other complications. Of course, Sally is a pro, and plans on using her Exploit program to create a more stable back door (see p. XX) after downloading the fire map but before logging off the system.
CYBERCOMBAT
You can't be invisible forever, and eventually, if you want to hack the matrix, you're going to wind up in cybercombat. Cybercombat follows the same procedure as other combat, using the same 12 second Combat Turn as combat in the physical and astral worlds.
Matrix Initiative
In Augmented Reality, you're acting at regular meat speeds. Use your physical Initiative and Initiative Passes as normal. You can choose to interact either with the physical world or the Matrix, or split Simple or Free Actions between the two.
If you're operating in VR, your Matrix Initiative equals your commlink's Response + your Intuition + 2, and you get two extra initiative passes. If you're operating in VR with a limiter, however, you receive -2 to your Matrix Initiative and -1 Initiative Pass. Limiter or no, if you want to interact with the physical world rather than the VR Matrix while in VR, you need to either go offline or concentrate on your meat body and spend a turn using physical Initiaitive (not forgetting the -6 dice pool modifier for physical actions in VR).
Agents and IC Initiative
Agents and IC have an Initiative equal to Pilot + Response. Because they act at digital speeds, they have three Initiative Passes.
MATRIX ATTACKS
Icons attack each other in cybercombat using the Matrix Attack action with offensive programs such as Attack, Black Hammer, or Blackout. To attack another icon, hackers roll Cybercombat + Hacking; Agents and ICs attack using their rating x 2. The defending icon rolls Response + Firewall. If the attacker scores more hits, the attack succeeds--note the net hits. Otherwise, the attack fails.
Matrix Full Defense
You can go on full defense as a Complex Action or as an interrupt action. When defending with Matrix Full Defense, add your Logic + Computer to the defense roll. IC and agents do not go on full defense.
Matrix Damage
The base Matrix damage inflicted by a program is equal to its rating in boxes. So an Attack 4 program has a base Damage Value of 4. Net hits scored on the attack test are added to the DV. Note that Attack programs inflict Matrix damage on the target icon. lack IC programs attack users directly through their neural interface, inflicting damage directly to the user's Stun or Physical Condition Monitor.
Damage Resistance
Matrix damage to an icon from an Attack program is resisted with System + Armor. Damage from a Black IC attack is resisted with Willpower + Biofeedback Filter. As usual, each hit reduces the DV taken by one.
Matrix Condition Monitor
Matrix Condition Monitors have 10 Boxes, not 12 Boxes. Light, Moderate, and Serious wound penalties are incurred at the usual points (1, 3, and 6 boxes respectively). An icon crashes when all the boxes on its Matrix Condition Monitor are filled. A device is bricked (broken/ destroyed unless repaired) if all the boxes on its Matrix Condition Monitor are filled, but only the Sparky program damages devices in this way.
If your persona icon crashes, you are immediately disconnected from the Matrix, as with the Jack Out action (p. XX). If you were operating in VR, you suffer dumpshock when this happens.
Dumpshock
Anyone who is dumped from the Matrix while in VR suffers dumpshock. The Damage Value for dumpshock is 6P for VR users without a limiter, and only 4S for VR users with a limiter. Dumpshock damage is resisted with Willpower + Biofeedback Filter rating. You also suffer disorientation in addition to the damage: a -2 dice pool modifier on all actions for (10 - your Willpower) minutes.
Black IC Attacks
Once Black IC is used to make a successful attack on the target, his connection is jammed open and he cannot log off that node until the Black IC is crashed. Any attempt by the user to jack out takes a Complex Action. In addition, the user must engage the program in an Opposed Test between the user's Willpower + Biofeedback Filter and the Black IC Rating x 2. If the Black IC ties or scores more hits, it prevents the user from jacking out. Users who jack out suffer dumpshock.
If Black IC knocks a user unconscious, it keeps the connection open. At this point, the system security may leisurely trace the user's connection. It is common practice to delete any data the hacker may have stolen off his commlink, or send a security team to search the victim's home for evidence.
Damage from Blackout will not overflow into the Physical Condition Monitor; it stops inflicting damage after rendering the target unconscious. Black Hammer damages users employing a limiter as if it was Blackout. Black Hammer overflows the Condition Monitor just like other damage, causing more and more brain damage.
At the gamemaster's discretion, if the user survives the experience, she may suffer migraines, phantom pain, tremors, hallucinations, memory lapses, or similar conditions.
Matrix Evasion
You cannot end a Matrix combat specifically by leaving a node, as IC or enemy hackers can follow you into the Matrix. Instead, you must be a running a Stealth program to have any chance of disengaging from a Matrix scuffle. If running a Stealth program, you must succeed in an Opposed Test pitting your Hacking + Logic versus the target's Computer + Intuition in order to escape the target's notice. "Popping Smoke" beforehand can give you an edge in escaping from Matrix Combat.
COMBAT SUMMARY
ATTACK:
Persona - Cybercombat + Logic
Agent, IC - Rating x 2
DEFENSE: - Response + Firewall
Full Defense: - Response + Firewall + Computer + Logic
DAMAGE VALUE: - Offensive Program Rating + Net Hits
DAMAGE RESISTANCE:
Attack: - System + Armor
Blackout/Black Hammer: - Willpower + Biofeedback Filter
SECURITY RESPONSE
Just because you have an account on a node does not mean you are free to run amok. There are plenty of dangers awaiting a hacker in a secure node, including but not limited to the following.
Spiders
A spider is a security hacker who protects the node, the physical facility to which the node belogns, or both. A single camera or a single car doesn't have a security spider dedicated to it, but a secure facility with dozens of cameras or a car dealership very well might. The GM must decide if a node deserves this kind of overwatch, as well as their numbers, abilities, and alertness.
Patrolling IC
Secure systems might employ IC to wander a node, scan users, and otherwise guard against intrusion. Remember that IC is far less expensive than hiring a spider. IC may be loaded with an Analyze or Track program and instructed to randomly check users to ensure they are legitimate. Patrolling IC that discovers a hacker will put the system on alert and may attack if carrying any offensive programs: or the system may launch other specialized IC for that.
ALERTS
If a node is aware that it has been hacked, it will immediately go on alert and initiate various countermeasures. These include launching IC, terminating connections, and--as an extreme measure--initiating a shutdown and rebooting.
When a node first goes on alert, it launches its initial alert response, a first line of defense. If the intruder does not leave at that point, or manage to kill the alert somehow, the alert tally will continue to mount. At various fixed points on the alert tally, the node will launch additional countermeasures or take additional actions to protect itself.
Once a node is on alert, it receives a Firewall bonus of +4. Alerts can be triggered by a hacker rolling a glitch or a critical glitch, by a node's System + Firewall detecting a hacker as he Speed Hacks an account, or detecting a hacker that has gained an account through Cautious Hacking when he logs on. Alerts can also be triggered by patrolling IC, legitimate users, and security spiders.
Alert Tally
A node on alert will make a System + Firewall Test at the end of every turn (remember that the Firewall has increased by 4 due to the alert). Every success rolled adds one to the alert tally. At various fixed points on the alert tally, triggered as the alert tally goes up, the system will initiate pre-programmed alert responses. These can include launching IC programs with various payloads, attempting to forcibly terminate the intruder's connection, or even when the alert tally reaches its maximum value, rebooting the entire system.
SAMPLE SECURITY RESPONSE: ISOLATED DEVICE
Patrolling IC: None.
Trigger Step Response Initial Alert Launch Rating 3 Killer IC Alert Tally 6 Terminate Connection Alert Tally 12 System Reboot
SAMPLE SECURITY RESPONSE: MEDIUM SECURITY NODE
Patrolling IC: Access Rating 4
Trigger Step Response Initial Alert Launch Rating 4 Bloodhound IC Alert Tally 5 Launch Rating 4 Warrior IC Alert Tally 10 Scramble Security Spider Alert Tally 12 Terminate Connection Alert Tally 17 Launch Rating 4 Crippler IC Alert Tally 22 Launch Rating 4 Doctor IC Alert Tally 27 Launch Rating 4 Non-Lethal Black IC Alert Tally 32 System Reboot
The alert tally does not reset to zero (no alert) until 1d6 hours after the intruding hacker leaves.
Terminate Connection
Once an intruder is identified and a restricted alert issued, a node with this response attempts to sever the hacker's connection by shutting down the port through which the node is being accessed. The node makes an Opposed Firewall + System Test against the hacker's Hacking + Logic. The hacker receives a +2 dice pool bonus if using a security account, or +4 if using an admin account. If the hacker used a passcode and legitimate account to log on, then the connection is immediately terminated. If the node achieves more hits, it disconnects the hacker. The hacker can attempt to log back on, but the node will be on alert and may have closed all outside connections.
System Reboot
As a last resort, many nodes will simply shut down their associated device in order to purge an intruder that is wreaking havoc. Shutting down and rebooting takes a System + Response (10, 1 Combat Turn) Extended Test. Anyone accessing the node when it shuts down is logged off, and all active programs are deactivated. The rebooting device has no node until it has completely rebooted (although it may be programmed not to boot back up until an outside security team has vetted the situation to be safe).
Intrusion Countermeasures
The most common security response is launching intrusion countermeasures. The gamemaster determines which programs the IC has loaded and in what order it uses them. Secure corporate systems will have an entire library of IC to throw at hackers, whereas some merc's cybereyes are only likely to have a single defensive program, if any.
IC has its associated payload programs loaded and running at the IC's rating.
Access IC
Access IC, also called Tattletale IC, has only the Analyze program loaded, and is only around to scan random users. It is almost never loaded as a security response, and is instead usually actively patrolling a node at all times. If it detects an intruder, it screams for help.
Killer IC
Not as bad as it sounds, Killer IC is the most basic form of proactive White IC. It only has the Attack program loaded.
Watchdog IC
Watchdog IC is like Access IC, except that it also has an Attack program loaded, and can do something about it if it detects intruders besides set off an alert.
Warrior IC
Warrior IC is Killer IC that's a bit tougher. It also has an Armor program loaded.
Bloodhound IC
Bloodhound IC, also called Trace and Report IC, has Analyze and Track programs loaded and is primarily interested in tracing an unauthorized user back to their home node. It then reports this information to its masters.
Crippler IC
Crippler IC, also called Trace and Dump IC, has Track, Exploit, Stealth, and Attack programs loaded. It doesn't slug it out with decker icons in cybercombat. Instead, it uses its Track program (or a tip from Bloodhound IC) to backtrace an unauthrozied user's home device. It then uses its Exploit program to back-hack that device, and uses its Attack program to start crashing your hacking programs one at a time, using the Crash Program action
Ripper IC
Ripper IC, also called Trace and Burn IC, is like Crippler IC only worse. Loaded with Track, Exploit, Stealth, and Sparky, it follows the same MO as Crippler IC up to a point. But instead of using the Crash Program action to scrag your programs, it takes a Complex Action to use the Sparky program and the Brick Device action against your commlink itself, trying to physically reduce it to slag. (Ripper IC, and only Ripper IC, can use the Brick Device action against a device over a Matrix Connection.)
Ninja IC
Ninja IC is advanced Warrior IC that is also loaded with Stealth, Smoke, and Mirrors as well as Armor and Attack. This allows it to strike in combat "from hiding", and with additional protection.
Doctor IC
Doctor IC is loaded with Medic and Armor, and uses its Medic program to try and patch up IC; it can also attempt to re-start critical programs that have been crashed, but it can't directly engage or interfere with intruders in any way.
Support IC
Souped-up Doctor IC, Support IC is bane to hackers. Harmless on its own, it is loaded with Armor, Smoke, Mirrors, and Medic. It uses its Armor and Mirrors programs to stay alive, uses its Smoke program to draw out Cybercombat as the alert tally rises, and uses its Medic program to perform real-time repairs on damaged IC in the node.
Non-Lethal Black IC
Non-Lethal Black IC is loaded with Armor and Blackout. More advanced and rarer versions may also have Stealth, Track, and/or Mirrors.
Lethal Black IC
Every hacker's worst nightmare, Black IC is loaded with Armor and Black Hammer. Rarer and even scarier versions may also have Stealth, Track, and/or Mirrors.
