The Matrix

• 1: Types of Matrix devices and their stats
• 2: Matrix Actions
• 3: Sleaze hacking on the wireless Matrix
• 4: Cybercombat hacking
• 5: Combat decking
• 6: Alarms
• 7: Additional rules
• 8: Furious Hacking in our Sprawlrunners

1 - Types of Matrix devices and their stats

Device types

Every device active on the Matrix falls into one of a small number of types:

• Commlink
• Cyberdeck / dronedeck
• Host
• Standalone device - any device that has a Matrix connection and isn’t one of the above.

Standalone devices connected directly to the Matrix are considered unattended. Unattended devices are very vulnerable to deckers. To protect them, they are often connected to a network that is controlled by a commlink, a cyberdeck, or a host. Networked devices cannot be directly hacked; the decker has to hack the network controller first, then the device second.

Matrix stats

All matrix devices are defined by a small number of stats:

• System Rating: a single die (d4–d12) representing how powerful the system is. Used to oppose some attempted manipulations and by ICE hosted on the system when attacking deckers.
• Hardening (also called System Toughness in Sprawlrunners): how resistant the system is to outside manipulations. Used as the target number for sleaze hacking rolls, and as the toughness target in damage rolls.
• Firewall (called Cyberspace Parry in Sprawlrunners): the device’s capability to block incoming hostile datastreams. Used as the target number for cybercombat hacking rolls.

For all devices except cyberdecks, Hardening is derived from System Rating in a similar manner to Toughness in normal SWADE; half the die type, plus a bonus. The bonus is 0/+1/+2 depending on the device type. Firewall is 2 if the device lacks any active intrusion scanning. If it has such protection, then it is equal to Hardening.

Stats

Statlines below are listed as ([System Rating]) [Hardening] / [Firewall].

2 - Matrix Actions

Offensive & defensive actions

Configuration commands

File and device actions

Rigger & drone actions

Misc

3 - Sleaze hacking on the wireless Matrix

Types of hacking target

Sprawlrunners’ RAW defines one type of hack target - nodes. In my houserules, these are expanded to include unattended devices and networks of devices controlled by a commlink, cyberdeck, or host. See Hacking the Wireless Matrix for definitions of these terms.

Local mesh hacking

All hacking against unattended devices or networks is done over the local mesh. This means the hacker must be able to reach the target via the local mesh, which has a typical range of around 50-100 metres (but can vary with local network conditions, Faraday cages, signal-blocking smartpaint, etc.)

To carry out the hack, the decker rolls Hacking skill vs the device’s Hardening stat (also called System Toughness in some places in Sprawlrunners; same thing). If hacking a network consisting of lots of devices, it’s the network controller’s rating that is used here.

All local mesh sleaze hacking rolls contribute to the local mesh alarm state as follows:

• successful hack with a raise - 0 points
• successful hack - 1 point
• failed hack - 2 points (and if the hack target was a network, the network owner is alerted)
• critical failure - 3 points (everyone on the local mesh is alerted)

All local mesh hacking is carried out in augmented reality.

Hacking unattended devices

The decker does not need to gain any sort of access before issuing hacking commands; common tasks such as opening a maglock or looping a camera feed is a single action and a single (Hacking) roll vs the device’s Hardening stat.

Hacking networks

To manipulate devices attached to a network, first the decker must hack into the device that is running it. Once there, the decker can manipulate devices on the network (eg snoop on phone calls, read files stored on the commlink, or trace the device’s precise physical location). Each of those is an action and a further Hacking roll against the network controller’s Hardening (note: not the device’s Hardening), same as Sprawlrunners RAW.

Any failed sleaze hacking roll against a network immediately makes the owner aware of the intrusion attempt; they will typically react by rebooting or shutting down their devices, unless they are distracted or have some reason to think they are not under attack.

If the network controller device is a cyberdeck or a dronedeck, the decker/rigger also gets a chance to notice successful sleaze hacks. They roll Notice versus the results of the Hacking roll. On a success, they realise what is going on.

Hacking networks controlled by hosts

A network controlled by a host can only be hacked by entering the host or node that controls it, in VR, and avoiding or defeating the ICE within. See Sprawlrunners for rules. Once a decker has gained access to the host or node that is running the network, they can issue commands to the devices connected to it.

When hacking tough hosts, it can be particularly useful to compromise a device in its network and use it as a back door

4 - Cybercombat hacking

The rules in hacking cover stealthy intrusion techniques so a decker can discreetly manipulate devices for their own ends. But if you want to take something offline right fraggin’ now, and you don’t care who knows about it – what you need is cybercombat.

Basics of cybercombat

• Attacker must have the Fighting utility loaded (or roll to improvise a replacement, as usual.)
• Roll Hacking skill against the defender’s Firewall value.
• Do base damage of 1d4 + Hacking skill. +1d6 if the attack roll had a Raise.
• Compare attack damage to target Hardening.

Calculate Shaken and Wounds as usual.

Matrix damage

Cyberdecks & dronedecks

As per Sprawlrunners core. Shaken applies to the decker using the ‘deck. Cyberdecks have three Wounds; if the device takes all three, it is crashed, and the decker must resist dumpshock.

Networks controlled by decks stay up and running (regardless of the deck’s Shaken and Wound state) until the deck is completely crashed.

Commlinks and other devices

A commlink or other device that is Shaken is put into a crashed state. Starting on the next turn, it can attempt to restart itself (on the owner’s turn, but not costing the owner an action) by making an unshake roll using the device’s rating die type. Until it does so, it is offline, cannot function, and cannot be targeted for further Matrix attacks. The owner/controller of a Shaken device can choose to immediately restart it as an action without needing to pass any test.

If the device takes a Wound (via a raise on the attack roll) then they are bricked. They do not function again until repaired.

Networks run from commlinks are much less robust than those run by cyberdecks. If the commlink becomes Shaken, every device on the network is Shaken (and hence unusable) with it, until the commlink comes back. If it is crashed, every device on the network is Shaken. They can roll to unshake as usual (just roll once for all of them), but will come back as unattended devices, without the protection of the network.

Consequences of crashing things

Smartweapons and similar gear that are Shaken can still be fired, as they have manual fallback controls, but they lose any bonuses they normally get from their electronics eg. smartgun bonuses. Note that it might be more effective for offensive deckers to use a DoS attack instead.

All cyberware is controlled via direct neural shunts to the user’s wetware, so crashing the cyberware’s Matrix component only inhibits minor parts of its functionality; it doesn’t brick it entirely. You cannot render someone’s cyberlimb or wired reflexes completely inert via a cybercombat attack, although you can impede their use with a DoS attack. A few pieces of cyberware do inherently rely on Matrix connectivity to work - like implanted commlinks - and they can be crashed via cybercombat, however.

5 - Combat decking

The rise of wireless hacking has made the decker much more useful and powerful on the modern battlefield. Deckers are now key parts of combat squads, performing counter-hacking, defening against attacking deckers, hiding their team from sight on the Matrix, and running denial-of-service attacks against opposing forces.

Denial-of-service attacks

A decker facing an opponent using wirelessly connected devices can distract them by interfering with the systems using a special form of the Test action (see SWADE pg 108), called a DoS attack. The decker makes a Hacking roll opposed by the target’s Smarts trait. The following modifiers apply:

• If the target has a few items of cyberware and/or wireless gear: no modifier.
  • If they have lots of gear, extensive cyberware, or both: +1 to the decker’s roll
  • If the target is a drone or vehicle working on autopilot: +2 to the decker’s roll
• If the target’s gear is protected by a network that the decker hasn’t hacked: -2 to the decker’s roll

On a success, the decker can inflict either Distracted or Vulnerable on the target, as they prefer. On a Raise, they can also inflict Shaken.

Matrix stealth

As a general rule, you cannot hide on the matrix. Any smart devices - and this includes many items of gear and most items of cyberware - inherently rely on the matrix to work at all, and so anyone glancing in your direction will see the corresponding icons.

There is an exception, however. A decker or rigger running an network from their cyberdeck or dronedeck can ‘hide’ it by minimising traffic and disguising the devices within it as innocuous ones.

The ‘deck must be running the Stealth utility. Hiding a network is also an active, ongoing action that requires quite a bit of attention from the decker or rigger at all times. Out of combat, this takes about half their time. In combat, it takes one action per turn (so they will incur a multi-action penalty if they also wish to act.)

To attempt a successful sneak, roll Hacking against a target number of 4 (if no-one is actively looking for the network) or opposed by Smarts (if people are hunting for it.) This test will need to be repeated every so often as the situation changes.

While a network is in hidden mode, all traffic between devices is cut to the bone. It can only be used for voice and text comms; streaming video is capped to low-resolution, riggers cannot Jump In, and most electronic items are only semi-functional (eg. no smartlink or tacnet bonuses.)

If combat starts and the network is still in stealth mode, the decker or rigger can drop the stealth and restore full functionality as a free action.

Tacnets

A tacnet is a realtime augmented reality overlay used by all members of a team to co-ordinate their actions and share tactical data. Tacnets were created for us by elite corp special-ops teams, but have been co-opted by shadowrunners and other criminals (at least, those who can afford them.)

Tacnets can only be run by a decker using a cyberdeck. They require a network controlled by a cyberdeck, and they require the cyberdeck to be running the Tacnet utility.

Game effects of tacnets

Tacnets extent the Command Range for all Leadership edges to include everyone using it (see SWADE pg 44).

At the start of combat, the character on the tacnet with the highest Battle score can take a test. This test is at +2 if the character’s have thoroughly prepared for battle and know the terrain, or -2 if the characters were ambushed. On a success, the tacnet earns an anti-Bennie. An anti-Bennie can be used to force one die reroll from the opposition, and the lower of the two results used.The anti-Bennie can be used by anyone on the tacnet, to force a re-roll of any action taken against them. This benefit expires at the end of the combat scene.

All of these benefits are lost if the network is crashed. This makes tacnets a priority target for Matrix attack during combat - and the deckers priority targets for physical attack.

Maintaining access to a hacked node from AR

Suppose a decker has hacked into a building facility’s security node in VR and now wish to move with the team while maintaining that access.

They can do so via a new utility called KeepAlive. This allows the decker to switch to AR while keeping their matrix persona active in the node. They can carry out actions against whichever node they are in as if they were still in VR, although they cannot move to other nodes without logging back in.

The decker has to keep KeepAlive in their deck’s memory to maintain the access. In addition, while running KeepAlive, the decker cannot act promptly to defend themselves; all ICE take +2 on all rolls against the decker’s persona.

6 - Alarms

Alarms are a game mechanic that simulate how aware the authorities are that there is an intruder, and how close they are to finding them.

Within a host, alarms capture the alert level of both the host’s autonomous defenses (ie. ICE) as well as any metahuman sysops. On the local mesh, they measure the alert level of the mesh itself, and local GOD agents guarding the nearest uplink node.

The alarm clock

There are separate alarm clocks for each host and for different parts of the local mesh. These clocks are typically 12-segment.

Incrementing alarms

Alarms typically increment by 1 point for each successful sleaze hack (0 with a raise) and 2 points for each failed hack.

If a Raise on the sleaze hacking roll can be used to make the hack more effective, then the decker can choose to use the Raise to avoid the alarm increment or improve the hack effectiveness, but not both.

Alarm consequences

Each time the alarm score is incremented, roll a d12. If the result is lower than or equal to the current alarm score, consult the table below to see what happens.

Local mesh

• 1-3 - no effect
• 4-8 - autonomous tracing persona start to patrol, running on the nearest uplink node. Treat these as Trace ICE.
• 9-11 - Killer ICE is deployed.
• 12 - a GOD counter-hacker with at least a d8 in Hacking and a mid-to-high-end ‘deck comes to kick ass and take names.

Hosts

Reducing the local mesh alarm score

Deckers can use a new utility called Spoof to dodge the effects of a high local mesh alarm score. Spoof works by routing all the decker’s traffic through a nearby device, setting it up to look like the culprit when the authorities notice.

The decker has to have had Spoof loaded before the first hack begun, and kept it loaded throughout. When Spoof is unloaded, the local mesh alarm value immediately halves (rounded down).

Spoof doesn’t help with host hacking.

7 - Additional rules

Commlink defence programs

Occasionally, particularly cautious people might spend some extra cash on defences for their commlink. These all require a commlink of d6 rating or higher; lesser devices don’t have the processing power required. Only one of the following options can be used.

• Active integrity checking: the commlink devotes a significant portion of its processing power to conducting internal scans, and a significant portion of its storage to storing known-good states that it can roll back to in an emergency. This provides a measure of defence against cybercombat. The device can use its Hardening stat in place of its Firewall stat.
• Encrypted storage: all files in the commlink’s storage are encrypted, with a rating equal to the commlink’s dice rating.
• Parabellum: the commlink runs a limited form of the Killer ICE. Each time a decker fails a Sleaze Hack or attempts a Cybercombat or DoS Hack against the commlink, the ICE will automatically respond with a counterattack, rolling the commlink’s Rating vs the cyberdeck’s Firewall. If it hits, it deals Rating+d4 matrix damage (+d6 on a raise).

Back doors

If a decker can get physical access to debug ports on a device, they can get easier access to hack into it. They take +2 on the Sleaze Hacking roll.

This can be used when hacking unattended devices or commlink networks but it becomes particularly potent when hacking networks controlled by hosts. The bonus applies if the decker can access any device in the host’s network, as well as any ports that are part of the host infrastructure itself.

To hack a host through a network device, the decker usually requires a toolkit and a roll of the lower of their Electronics and Repair to open up the device and hook up the necessary connections. If the decker succeeds, they take +2 on all actions in the connected host node.

Host sysadmins are aware of this weakness, and do not usually put external devices like cameras or maglocks onto networks for that reason. Security networks tend to be reserved for more serious defences that are harder to get near, like turrets or security guard’s weapons.

8 - Furious Hacking in our Sprawlrunners

Overview

Furious Hacking (FH) presents a new set of streamlined rules for host hacks in a cyberpunk game setting. It is faster to resolve than Sprawlrunner’s “Slow Burn” hacking rules, but offers a more dynamic and exciting difficulty ramping mechanic than the “Fast Lane” hacking option.

As written, FH covers a ‘classic’ no-wireless cyberpunk scenario of an operator hacking into a computer host. It doesn’t cover a few scenarios that we use at our table that derive from 5e/6e Shadowrun: wireless hacking, tactical use of hacking in combat, and so forth. This document presents some ideas for expanding FH to cover those.

Proposed modifications

Hacking into hosts/systems

All aspects of hacking into hosts can be run as per FH. As in my existing rules, hacking into hosts is always undertaken in VR, and the operator’s body is consequently in ragdoll mode.

A hacker does not need to be physically connected to a system in order to hack it; they only need to be within local mesh range (see below).

Note that wireless Matrix signals use high-frequency ultrawideband radio, and so very easy to block via physical means. Many secure corporate facilities will therefore use embedded Faraday caging in their construction to limit the size of the local mesh to their walls, making them very difficult to hack from outside the perimeter. This is expensive, however, as it means they will then need to run all building facilities via an on-premises system as well as running their own private uplink system.

Host/system active defences

Particularly valuable hosts might have, as a last line of defence, either metahuman counter-hackers or nearline-sapient Black ICE. These are always played as Wild Cards and will attack the intruding operator in cybercombat.

Keepalive

Once a hacker has logged in to a system, they can disconnect from VR, switch to AR, but maintain their persona’s presence in the host. From there, they can continue to issue “control a device” commands to the system. These use slice rolls and then opposed rolls as usual.

While running under keepalive, the operator cannot benefit from the Exotic Utilites Edge, as they are limited by their meatspace reflexes. Nor can they use more complex Matrix actions like finding or manipulating information, or manipulating an entire subsystem.

Keepalive allows a hacker to move with the team through a facility, dealing with security measures as they go, without having to constantly dip into and out of VR.

Backdoors

A hacker can work more effectively inside a system if they can get physical access to a trusted device. If they can crack the device open and improvise a connection to its debug ports, they can exploit its trusted status.

To do this, they’ll need an electronics kit, a suitable device (a commlink, camera, almost anything that is connected to the system they are trying to hack), some time, and a successful roll of Electronics. If the device is armoured against physical attack, a roll of Repair may also be necessary to get into the guts of it without damaging the delicate components within. Alternatively, the GM can call for a single roll of the lesser of the operator’s Repair and Electronics skills.

If the operator succeeds in this, they gain a bonus +2 slice rolls, the same as if they had pre-existing security grade credentials on the system.

Device hacking on the local mesh

The wireless Matrix is divided into cells. Within each cell, devices use peer-to-peer connections to pass traffic around; this is called the local mesh. At the centre of each cell is an uplink host that is actively guarded by GOD counter-hackers. All traffic between devices in different cells passes through the uplink host. Uplink hosts are connected to each other via fibre cables, satellite links, and other hardline communication infrastructure.

Hackers are free to attempt hacks against any devices within their local mesh, but hacks against or through the uplink host are widely regarded as suicide. This means hackers must always be within local mesh range of their targets.

Treat each cell as its own system, per the FH rules. This represents a combination of anti-malware scanning by the devices within the mesh as well as traffic inspection from the uplink host.

For the purposes of determining slice rolls, treat the local mesh as a system of d4 to d8 value (ie. blue, green, or orange). Blue would apply in poor neighbourhoods, where the devices are cheap and GOD are not watching; orange would be downtown where people are carrying fancy commlinks and GOD are ever-vigilant. In the slums, also apply the “lax security” modifier (+2 slice rolls); in corporate facilities, the “extra tight” modifier will probably apply (-2 slice rolls.)

When determining the actual opposing dice type for any roll, however, consider the device being hacked. A fancy commlink does not become easier to hack because the owner has travelled into the slums; it still opposes with d8 rather than d4. But slice rolls work against it as usual, as they are a function of the local mesh network working as a whole noticing the hacker’s nefarious actions.

Apart from that, all normal FH rules apply, including slice rolls, opposed rolls, and card draws to determine consequences of failure.

As in my existing rules, all local mesh hacking is carried out in AR.

The Exotic Utilities Edge (reduces the multi-action penalty) does not apply to any hacks done in AR. You’re still limited by your meatspace reflexes.

Networks

Networks are ways for operators to use their ‘deck to construct secure areas on the local mesh. Each device inside the network severs its connection to the local mesh, communicating only with the cyberdeck. The cyberdeck inspects and filters all traffic to and from the device, sheltering it from hacking attacks.

Devices inside a network cannot be hacked (but they are vulnerable to DoS attacks; see below.) A hostile decker’s only option is to take the network down first, either by engaging the decker in cybercombat and crashing their deck, or by meatspace means - a bullet in the cyberdeck is a popular choice…

Maintaining a local network uses a portion of the cyberdeck’s power and the operator’s attention. The network will disconnect if the operator enters VR. This also means networks are limited in size, typically to only a dozen or so devices. It is not practical for even very secure corp facilities to have all their security cameras hooked into a network.

Networks only apply on the local mesh and for AR hacking.

Hiding a network

The operator running a network can choose to minimise and disguise all traffic within it, effectively making the constituent devices disappear from the Matrix.

This requires active monitoring from the operator, and in combat, one action each round must be spent maintaining the stealth. This means combining it with any other actions will result in a multi-action penalty, as usual.

Hiding a network involves a roll of the operator’s Hacking skill. An observer can only have a chance of noticing a network if they have some sort of running AR system. If the observer is a counter-operator using a cyberdeck, they can oppose the Hacking roll with their Notice skill. If they are just normal schlubs with commlinks, the Hacking roll is unopposed.

Hiding is not available when working inside a system in VR. It only applies in AR/meatspace.

Cybercombat

Cybercombat is any operator-vs-operator or operator-vs-Black ICE combat. Cybercombat can take place in VR or AR.

Treat cybercombat as similarly to melee combat in SWADE.

Give each deck a die type rating, depending on the decker’s Edge rank; Deck Builder = d6, Deck Optimiser = d8, Deck Customizer = d10.

• Attack actions roll Hacking skill.
• Firewall (‘cyberspace parry’) is 1/2 the operator’s Hacking skill, +2
• Integrity (‘cyberspace toughness’) is 1/2 the deck’s die type, +2
• Damage is equal to the deck’s die type plus the operator’s Smarts. +1d6 if the attack was a Raise, as usual.
• Some meatspace actions also apply in cybercombat, such as:
  • Defend (+4 to Integrity, cannot take any actions)
  • Ganging Up
  • Wild Attacks (+2 to Hacking, but becomes Vulnerable)
  • …more…
• If an operator attempts a graceful logoff, their opponent gets an immediate Free Attack, similarly to withdrawing from combat in meatspace. Alternatively, they can yank the cable from their deck, avoid the Free Attack, but will take Fatigue as usual from dumpshock.

Resolve damage to determine Shaken and Wounds as usual.

When operators fight each other, each Wound is only applied to their respective cyberdecks. When operators fight Black ICE, the Wounds are applied to the deck and the operator.

Denial of service (DoS)

Almost all electronic devices and cybernetic systems maintain a connection to the Matrix for secondary functions, diagnostic reporting, and similar. Hackers cannot disrupt the primary interface or functionality of a device; they cannot turn off someone’s cybereyes, prevent a smartgun from firing, remotely detonate a grenade on someone’s belt, or force a vehicle to crash by overriding someone who is manually driving it.

What they can do is a Denial of Service attack. DoS attacks involve a hacker flooding someone’s electronic and cybernetic systems with bad traffic, jamming up their responses and making them glitchy and unreliable.

DoS is resolved as a Test action, pitting the operator’s Hacking skill versus the Smarts of the target. The operator takes -2 to +2, depending on the number of electronic devices the target has. Targets with no electronic gear at all are immune to DoS attacks. Resolve Distracted/Vulnerable/Shaken outcomes as usual for Test.

Tacnets