CYBERLIFE

01Overview

You are an operator. Your localhost is your base: you leave from it, come back to it and keep your things there. Everything else happens outside, on a network shared with the other players.

The basic loop: you leave localhost, reach a company across the network, get onto its machines, take what they hold, then go and sell your cargo. Every step costs something: tolls, time, and above all traces. A company that reads its logs ends up cutting you off.

Companies come in three tiers. A T1 is open. A T2 or a T3 is locked: you need a 0-day for its sector, a key or a foothold to get in. The higher the tier, the more the loot is worth and the faster the monitoring.

Around this loop, each class has a trade: orders from NPC clients and players, a rank that goes up, and powers that change how you play.

02First steps

The tutorial is played on a private network. It takes about ten minutes.

You get into a small company through a noisy or a quiet door, take some loot, an analyst spots you and you get out before the cut. On the way back, another operator grafts onto your session: scan shows where they are and burn <machine> disconnects them. Nothing that happens in the tutorial is lost for good. At the end, you choose your class and arrive on the shared network, in the Nord region.

Localhost

Your home AS is shown in status. localhost takes you home, only from that AS: your loot is sold at base price and your documents are filed. online takes you back out. From another AS, localhost drop cuts your session and leaves your cargo behind.

relocate <AS> moves your localhost to another transit or exchange, for $10,000. The price is shown before you confirm with relocate <AS> ok. Your things follow.

The free proxy

For 24 hours after the tutorial, you wear a free level 1 proxy: players without a probe cannot see you or hack you. A player with a probe can still find you. Taps and the Agency are not fooled by the proxy: its checkpoints search large cargo from the first hour. Tolls stay at base price for those 24 hours.

Knowing what to do

• objective offers optional steps (objective key, objective analyst, objective trade). objective off hides them.
• mission gives the first three orders of your class.
• progress gives what comes next once those are done: opening the regions, your first 0-day, first T2, first T3, holding an AS. Each step says how to do it and pays a reward.
• status: where you are, what you carry, what is around.
• report: income, spending and losses over your last ten trips.
• world: what just happened on the network.

03The classes

At the end of the tutorial, you choose one of five classes. You can change once for free with class <name>; after that the choice is final.

Every class plays the basic loop. The class adds moves during a break-in, a trade (orders to fill) and a rank in that trade.

Infiltration

Explores and sells access. scan shows them a company's whole internal network.

• crack <machine>: open a locked machine without a key. 10 s in a T1, 20 s in a T2, 60 s in a T3, less with practice in the sector.
• spot: show where the loot is. With practice, it is instant and also shows the analyst.
• foothold: set a foothold on the machine you are on ($900, then $200/h). An access order pays for it; otherwise you sell it.

Rank 2: two takes per break-in instead of one. Rank 4: crack twice as fast.

Exfiltration

Plans routes and moves large hauls. With cargo, they hop faster on links they know. go routes them around Agency checkpoints when they carry something worth searching.

• tunnel <AS>: build a tunnel on a link crossed with cargo at least five times. No toll and no interception, for you and whoever you allow. $3,000, then $150/h. Two tunnels, three after ten deliveries.
• scout: see taps, hunters and tolls two hops ahead, three on known links.
• market <AS> take: carry a client's cargo for a fee.

Rank 2: neither Agency checkpoints nor player taps search your cargo. Rank 4: with cargo, every hop takes 3 s.

Misdirection

Misleads defenders and sets traps.

• decoy <machine>: in 4 s, fake noise pulls the analyst onto another machine. Set where the analyst already is, it keeps them there. After ten analysts fooled in a sector, decoy <machine> <player> covers a teammate.
• obscure: at the Agency, a false trail hides a client's heat for an hour, then it comes back doubled. After five false trails, two hours and a lighter return.
• bait convoy <AS>: announce a fake convoy to draw players in.
• scam, disguise: a fake listing on the market, or putting your heat on a rival's name.

Rank 2: once an hour, your decoy sends the Agency raid down a false trail. Rank 4: decoy and obscure twice as fast.

Erasure

Handles surveillance and clears clients' files. On the network, cover disconnects intruders from their session for $400.

• cover: wipe your traces on the machine, $400, once per break-in. 20 s, less with practice. After ten successful covers in a sector, it wipes the whole company.
• clean: destroy a file at the Agency (60 s in the records room). A thin file is destroyed at the Paris IX desk.
• disguise <name>: pin your recorded traces on another player.

Rank 2: a spotted exit no longer adds evidence to your file. Rank 4: two covers per break-in.

Developer

Builds 0-days and equips the others.

• analyse: research a vulnerability on the machine you are on. The research has the company's tier. Two analyses per visit, then the company is closed to analysis for an hour.
• zeroday <sector>: at localhost, build a three-charge 0-day from a research of that sector. $3,000 for a T2 (10 min), three times that for a T3 (30 min). It can be sold on the market.
• refine <sector>: two researches of the same sector and tier make one of the tier above ($800, 10 min). It takes no arsenal slot.
• zeroday skeleton: a 0-day that opens every sector but wears out faster. You must have forged in three sectors. It asks for ok before taking your researches.
• market <AS> take: build an ordered 0-day for a fee.

Rank 2: you forge and refine anywhere on the network, not only at localhost. Rank 4: one more analysis per visit.

Trade and rank

Your rank goes up with trade points. They come from:

• NPC orders for your class (mission for the first three, then market orders);
• contracts on the board (jobs): one point, two if they are marked with your class;
• what you sell to other players;
• loaded exits from a T2 (one point) or a T3 (two points), at most four points an hour.

There are ten ranks. Rank 1 comes at 3 points, rank 2 at 10, rank 3 at 16, rank 4 at 20, then 30, 70, 120, 200 and 320. Each rank adds 10% to NPC client fees and gives something else: a power at rank 2, a second one at rank 4, localhost axes at ranks 1, 3 and 5, arsenal slots, more keys. class shows your rank and what you are missing.

NPC clients place at most four orders an hour. The first three orders (mission) pay $600, $1,000 and $1,600 and are taken at an exchange. They do not expire.

04The network

The network is made of autonomous systems (AS) joined by links. Moving means hopping from AS to AS.

Moving

• neighbors: the neighbours of the AS you are on, with their tolls.
• hop <AS>: hop to a neighbour. A hop takes a few seconds.
• route <AS> (or traceroute): see the path and its tolls without moving.
• go <AS>: follow the path on its own, paying the tolls. stop interrupts it. Clicking a node on the map prepares the command.
• map: your surveys, with their date. The network may have changed since.

The toll is paid when you leave an AS. It depends on the type of AS:

On an AS held by a player, that player sets the toll and collects it. AS nobody holds raise their toll when a lot of traffic goes through.

Transit and peering

There are two kinds of link. Transit costs money and records your passage. Peering is free, but it only leads to the neighbour's customers: you cannot chain peerings to cross the map. An exchange links all its members in the region, and a member you reach from an exchange also leads to the other exchanges of the region.

Regions

Regions are joined by gates. The Nord gate (AS799) opens after a first sale and a clean exit from a T1: getting out with loot before any of your traces reaches the company. The Rhin-Ruhr gate (AS899) needs a clean exit from a T2. status says which gates are open for you and what you are missing.

The darknet

Some AS are announced nowhere: AS666, AS667, AS668. You find them by exploring. Their fences pay 140% of base price, against 115% at an exchange. Player shops and the keepers' 0-day shelf are there too (see the market).

Agency checkpoints

Every hour, the Agency holds two transits per region. Whoever lands there with more than $1,500 of cargo is searched, once per checkpoint and per hour: a quarter is seized, half if a raid is after you. During your first hour after the tutorial, you are let through, except above $5,000. route and go flag checkpoints on the path: with cargo, go stops before one and waits for go <AS> ok. A runner (Exfiltration) goes around them, then passes unsearched from rank 2.

What moves without you

About once an hour, an event is announced to everyone and listed in world:

• a published flaw opens a sector's medium companies without a 0-day for two hours, but the first break-in puts the whole sector on guard;
• a maintenance window, announced an hour ahead, stops a large company's monitoring for thirty minutes; it stays locked;
• an outage takes a transit link down for an hour. Only a tunnel gets through.

More rarely, an infrastructure in liquidation appears behind a T2 or T3 AS. It is not announced: the first player to read it with enum reveals it to the whole server. Inside, three levels and vaults that do not refill; scan names them. If an analyst cuts you off before you took anything, the charge the door's 0-day spent is given back. During the liquidation, its AS has a single exit, and whoever waits there can take what comes out.

05The break-in

Breaking into a company means moving from machine to machine to what it holds, without getting cut off before you leave.

Read, then enter

• targets <sector>: the companies of that sector on the AS you have surveyed, with their tier and what is left to take.
• enum <company>: its services, its monitoring hours, its logging level (log X/3), and what it takes to get in. Each service says whether the entry is noisy or quiet.
• enter <company> <service>: get in through that service. You can also get in with a key from your keyring or a foothold already set.

A T2 or a T3 is locked. A 0-day for its sector, carried on you, opens the door and loses a charge. A door watched around the clock, or a sector under heavy pressure, costs one more; enum says so beforehand. If the vault becomes unreachable while you are inside, the charge is given back when you leave.

Moving inside

• scan: the neighbouring machines. A machine that leads further says so.
• read <machine>: what a machine holds, whether it is locked, and whether it leads further.
• pivot <machine>: move to a neighbouring machine. A locked machine needs its key: picked up on the way, or already on your keyring.
• follow <machine>: go in behind someone who just opened it, without the key. It leaves two traces.
• take: take what the machine holds. It is the noisiest move.
• use <tool> [machine]: run a tool you carry.
• leave: get out. The keys you picked up go to your keyring.

What a company holds

A company has several stocks: the loot, credentials (keys), access (to set a foothold) and crafting material. The loot runs out for everyone and refills over time: coming after someone else pays less. Material is copied without taking anything from anyone. enum says whether the company is full or emptied.

Traces and the analyst

Every move leaves traces on the machine. About ten seconds later, they reach the company's SIEM. When enough traces have left one machine, the company connects them, then an analyst comes to look at the noisiest machine. A few seconds later, they cut it off: if you are on it, you lose what you have not got out yet. A machine that was cut stays unplugged for about 25 minutes, and what was behind it cannot be reached.

A company does not have one analyst per machine. Changing machines, making noise elsewhere or leaving in time is the whole game. The break-in log says when a trace leaves, when the analyst arrives and on which machine.

Hours

Each company has monitoring hours, in Paris time, shown by enum. Outside them, an on-call analyst can still come, 2.5 times slower. A T3 reads as fast at night as by day. A bank reads faster than a small workshop.

Clean exit, spotted exit

An exit is clean if none of your traces reached the SIEM. Otherwise it is spotted: the company notes it, and the Agency adds evidence to your file if the company was monitoring at the time. A spotted exit from a monitoring T2 or T3 also gets your loot flagged: fences pay 30% less for it.

Keys and footholds

• A key reopens a company through a quiet entry, without a 0-day. Your keyring has a limited size: when it is full, the oldest small keys make room for new ones. keyring lists them.
• A foothold (plant, $900 then $200/h) is a way back in set inside a company. A machine that gets cut takes its footholds with it. footholds lists them.
• The implant is a silent foothold, expensive, that a rival can burn.

06Loot

What you take becomes your cargo. You still have to sell it, and carry it there.

With cargo, you are visible on the network. A tap can seize everything on a link, a player can graft onto your session, an Agency checkpoint can seize part of it. Loot never teleports.

estimate <AS> and estimate localhost show what your cargo would fetch and the tolls on the way, without selling.

Documents

Some loot is worth what it allows more than its price: deeds, plans, ledgers. At localhost, they go into your stash instead of being sold. A plan lets you build a reusable tool (craft <tool> spec <plan>). stash carry <doc> takes one out, stash sell <doc> sells it at base price.

07Crafting

Material picked up in companies is used to build tools at localhost. You pay to rent the machine.

There are two families of material. Hardware (compute capacity, memory, storage, bandwidth) and technique (code repository, signing certificate, test environment, vulnerability research, build chain). You copy it with take on the machines that carry it.

recipes lists the recipes. craft <tool> builds, arsenal shows what you have and what you can build, arsenal carry <names> takes tools with you, use <tool> runs them. A tool works once. The arsenal has a limited number of slots.

A rare part added to a recipe gives an exception variant (craft <tool> +<part>), stronger but perishable. The primer (a one-use entry that leaves no trace) and the implant have an exact recipe.

0-days

A 0-day opens a sector's locked companies, at the tier it was built for. There are three ways to get one:

• a developer builds it (three charges) and sells it or delivers it to order;
• the darknet keepers' shelf (market AS666) offers some, renewed every hour: sometimes a one-charge 0-day for a single door, around $4,500 for a T2 and $15,000 to $25,000 for a T3, otherwise multi-charge 0-days;
• the keepers build one to order (market AS666 zeroday <sector>), at a higher price.

08Living rarity

A vulnerability that gets used too much ends up known, published, then patched.

Rare parts (vulnerability research, signing certificate, build chain) carry a generation. When a generation has been copied too often, by all players together, it is published: copies of that generation are worth nothing, tools built on it are burnt, and the source comes back later with the next generation. The arsenal marks these tools BURNT before you run them. Common material can be copied without limit.

Keys rotate too: a company ends up changing its credentials, and a key that was sold or noticed stops working. keyring says which ones are still valid.

09The Agency

The Agency collects evidence against you. It is what makes mistakes costly over time.

A spotted exit from a company that is monitoring adds evidence to your file. dossier shows your heat and what is known about you. The file loses one piece of evidence every 20 minutes, three times faster at localhost.

• At 8 pieces of evidence, a bounty is put on your head: a player who catches you collects it.
• At 14, a raid can come: an Agency hunter can take your cargo at any crossing, and every checkpoint searches you and seizes half.
• None of this during your first 45 minutes of play.

A thin file (8 pieces of evidence or fewer) is destroyed at the Paris IX desk (AS401) with clean, without a break-in. A heavy file is destroyed at headquarters, on AS690, a T3 watched around the clock: you have to get in, reach the records room and run clean. An Erasure player does it for clients too, and a Misdirection player can lay a false trail (obscure).

The more heat you have, the faster the operator takes back the AS you hold.

10Territory

Taking an AS means collecting the tolls of those who cross it, players and NPC traffic.

Taking and holding

Get into a transit AS with enum <AS> then enter, go to the machine that decides its announcements (control) and type claim. as <AS> estimates what the AS earns and what it costs before you pay. An AS in front of T2 and T3 companies costs more and sees more traffic.

Then as <AS> toll <neighbour> <price> sets the toll on each exit. as <AS> close/open <neighbour> closes or reopens a link (an exchange can never be closed). as <AS> register shows who went through, with or without cargo.

Retake and upkeep

The operator takes an AS back after 3 hours if it is not defended, 8, 18 or 36 hours with one, two or three defence modules (as <AS> defend <module>). Your heat shortens this window: with 6 pieces of evidence, it is halved. claim shows the real window before you pay. as <AS> maintain ($900) restarts it from zero.

Defending your AS

When someone gets into your AS, you are warned. Get in yourself: inside your own AS, scan shows where intruders are, or that there are none, and burn <machine> throws out the one on it ($300). You are also warned when an intruder leaves. If they reach the control machine before you, they take the AS. Everything you hold outside counts against your capacity: AS, taps, footholds.

Everything you hold outside is paid by the hour: AS, modules, footholds, tunnels, taps. Upkeep grows with each thing held and with your notoriety. If you cannot pay, you lose your most recent AS. Check in as <AS> that the tolls cover the costs.

Taps and other moves

• as <AS> tap <neighbour> sets a tap on an incoming link: the first player with cargo who crosses it leaves the cargo there, not their tools. route shows taps to other players, and nothing is seized in the Nord.
• as <AS> hijack <AS> announces another AS's prefix for 30 minutes: its traffic comes to you ($2,500). An AS with the rpki module cannot be hijacked. as <AS> hijack <AS> stop gives it back early.
• as <AS> offer <price> puts the AS up for sale, as <AS> acquire buys it, as <AS> divest hands it back to the operator.

11The market

Orders, contracts and shops.

Orders

market orders lists, from anywhere, the requests of NPC clients and players: carry cargo, build a 0-day, set an access, clean or obscure a file. On site, market <AS> take <n> accepts one. market drop <kind> gives back an order you will not finish. A player places an order with market <AS> carry, forge, acces, clean or brouiller, and the money is held until delivery.

Contracts

Each exchange has a board of three contracts, renewed every 15 minutes: jobs, then job accept <n> (two at a time). A contract lasts an hour and is settled when you leave the target company: get out with loot, without a trace, during its hours, with a key, or resell its loot. A research contract is for developers only.

Shops

Shops are held on unannounced nodes. market <AS> reads the ones there. You list loot, tools, keys, material or map surveys at your own price, and buy with market <AS> buy <name>. The proceeds of a sale stay in escrow with the keeper until market <AS> withdraw. The keeper sets the commission and can drain the escrow: players are warned 30 minutes ahead, and the shop's drain counter shows it to everyone.

12PvP

A player carrying cargo can be hacked by another player on the same AS.

intercept <player> grafts you onto their session. scan and pivot lead to the flux machine, where take starts an 18-second transfer (9 with a session 0-day). You have to stay on flux meanwhile. The transfer takes half of each lot; a client's parcel goes whole.

The victim is warned at once. They can disconnect you with burn <machine> ($300, even if they pick the wrong machine), go home to localhost if they are on their home AS, or run. burn flux works even from inside a company, where scan also shows the intruders on your session. If they run, the attacker has 8 seconds to hop after them on the same link: the transfer then resumes for 9 seconds where they land. Otherwise they are safe.

who says who is laden or empty, and whether their session is hardened (T2, T3): you then need a skeleton key or a primer to get in. Agency hunters take the whole cargo, and a fleeing player only escapes them if their hop lands within 6 seconds.

Where it happens: nobody hacks anybody in the Nord or on an exchange, and taps take nothing in the Nord. In Western Europe, whoever grafts onto you is visible. In Rhin-Ruhr, it is open.

Proxy and probe

To hack a player, you first have to see them. A level N proxy hides you on an AS: without a level N or higher probe, others see "1 masked presence", neither your name nor your cargo, and intercept cannot find you. On an exchange, everyone is visible.

probe pierces the proxies of its level or lower on the AS you are on. It costs one of its ten charges, nothing if nobody is masked. Pierced players stay visible to you for 10 minutes on that AS, and they are warned: they can leave. On the third pierce while you carry cargo, a proxy drops a level; empty, it does not wear.

They are sold on unannounced nodes: proxy buy <level> and probe buy <level>, then ok. proxy shows yours, its level and its wear. If you cannot pay the upkeep, the proxy goes dark. It fools neither taps nor the Agency.

Each class has its moves. Infiltration grafts without showing until they take something. Exfiltration hops faster with cargo, so it flees and chases better than the others. Misdirection sets fake alerts and fake cargo (decoy flow, scam cargo). Erasure disconnects every intruder at once (cover on the network, burn alone). Developers build the firewalls and session 0-days the others buy.

13Progression

Your character grows in two ways: the rank of your trade, and the axes of your localhost.

Rank is described with the classes. Axes are bought at localhost with base upgrade <axis>: the price and the gain are shown before you confirm. The first level costs $4,500, each next level 1.7 times more.

The first three axes go up to level 5, the other three to level 3.

14Quick reference

help gives the list in game, help <command> the details.

15Glossary

• 0-day: an exploit that opens a sector's locked companies. It has charges.
• Analyst: the one who comes to look at the noisiest machine, then cuts it off.
• AS: autonomous system, a node of the network (AS###).
• Clean exit: getting out before any of your traces reaches the company's SIEM.
• Cut off: the company unplugs the machine you are on. You lose what you had not got out.
• Exchange (IX): an AS without PvP, with a fence, contracts and orders.
• Foothold: a way back in, set inside a company.
• Heat: the evidence the Agency holds against you.
• Localhost: your base. Where you start, sell and build.
• Probe: what pierces proxies of its level or lower.
• Proxy: what hides you from other players on an AS, by level.
• Rank: your standing in your trade, from "unknown" to "reference".
• Tier (T1, T2, T3): the size and protection of a company.
• Trace: what a move leaves in a machine's logs.