You are on page 1of 14

BLACK HAT MAGIC

const BY = "Brendan Cass"


+ "Skirmisher Game Development Group"
BLACK HAT MAGIC
const BY = “Brendan Cass”
+ “Skirmisher Game Development Group”

Skirmisher Publishing LLC


499 Mystic Parkway
Spring Branch, TX 78070

Website: http://www.skirmisher.com
Email: d20@skirmisher.com

Artist: Brendan Cass

Editor/Layout & Design: Michael O. Varhola

Contents of this publication Copyright 2017 by Skirmisher Publishing LLC,


all rights reserved. First Publication: November 2017.
A
dvanced computer and magic users share many traits, including their eccentric natures, propensity
to recluse themselves, and shared taste for comfortable clothing. It stands to reason therefore, that
if the respective users of these arcane skills share personality traits, that they might use their
abilities in similar ways as well. One phenomenon that makes for a fascinating study, but lacks a
magical counterpart in any game this author has played, is computer malware. This article will explore the
various types of malware and, with a little creativity, attempt to describe what the magical variety might
look like, and finally provide a Pathfinder “Spell Hacker” prestige class as an example of how to make use
of these concepts.

Hoax
Computer hoaxes of the mundane world are 99
percent social engineering, 1 percent computer
knowledge, and completely harmless if identified
for what they are. Hoaxes are typically spread
through chain emails but it is not uncommon for
them to appear as pop-ups on less-reputable
websites. The goal of a hoax varies with its creator,
and can range ffrom simply propagating itself to
convincing victims to perform some potentially-
harmful action on their computer themselves (e.g.,
deleting important system files). Regardless of its
intent, however, the best way to avoid the
consequences of a hoax is to ignore it and typically
only those that do not know any better are taken in.
Hoaxes appear first in this article because they
do not require much actual computer use to create,
and so finding a magical parallel should be very
easy. Delivering a magical hoax could be done with environment and deliver their payloads. Common
a letter — the same way computer hoaxes are delivery techniques include “lost” thumbdrives that
delivered by email — or it could be done with an have been left in public spaces, email attachments,
illusion spell and deliver its message through sound or, as in the case of the famous “Koobface” Trojan,
and sight. Such an illusion might, for example, take social networking sites like Facebook. Trojan
the form of a member of a council of mages or some payloads are as varied as they are malicious and
other trusted individual in the spellcasting can contain backdoors (which allow an attacker
community and suggest that a rampant magical virus remote access to a computer or make it part of a
requires the recipients to excise all copies of the botnet), keyloggers (which allow an attacker to steal
Magic Missile spell from their spell books. Magical personal information), or targeted programs (which
hoaxes will probably only affect the most gullible are just written to cause damage on the targeted
or low-level of spellcasters, and might be created machine).
by both pranksters and malicious mages alike. The most obvious magical Trojans are cursed
items, but with a little creativity other delivery
Trojan Horse methods can be found. Magic scrolls and potions
Anyone familiar with the story of the Trojan Horse might contain Trojan spells and may be left by a
is familiar with the origin of this sort of virus, which cunning, evil wizard for an adventuring party to
is often referred to just as Trojan for short. Like their find. For example, a spell contained within a Trojan
wooden predecessor, Trojans attempt to disguise Potion of Cure Light Wounds might be a Charm
themselves as something benign or even beneficial Person spell or a divination that allows a wizard to
in order to be brought into a user’s protected spy on the imbiber. A magical Trojan should not be
d-INFINITY
Black Hat Magic

interesting magical analogues.


A viral spell following the model of a computer
virus would reinfect its target even after the original
effects had been dispelled. A viral spell that takes
effect on “startup” might reinfect the targets
whenever they wake up from sleep, or when they
are preparing their spells for the day.
“Runtime” viral spells would target a specific
spell, and so whenever the victim casts that spell
the virus would be triggered. Viral spells would be
fairly easy to detect but difficult to remove, and most
viral spells would attempt to protect themselves
from being dispelled by the target and might need
the assistance of a powerful third-party wizard to
remove. Effective viral spells, like their computer
counterparts, would be complicated to cast, and so
only spellcasters of substantial power would be able
to manage them.

Worm
obvious under standard or even rudimentary Computer worms deserve a special mention because
magical observation and would take a relatively of their method of propagation. Unlike viruses,
advanced spellcaster to create. which require some kind of continued action from
the creator to spread, worms have the ability to
Virus propagate built into them. A worm will typically
Computer viruses are defined by their ability to use the infected computer’s local network to
insert themselves into other programs and self- distribute itself to other vulnerable machines, which
replicate. Viruses find their way onto a target will then attempt to infect the computers that they
computer forcibly and often do so by taking can access and so on, ad infinitum. Worms do not
advantage of security holes in its existing software. need to be inserted into system files on the infected
Adobe Flash, for example, has been used by many machine either, and their replication is taken care
viruses as a tool for infecting target computers. A of by other infected machines on the network and
machine with an unpatched copy of Flash need only they will attempt to reproduce themselves as fast
visit a malicious site in order for the virus to exploit they can, and this is the reason why worms are
the vulnerability and execute code on the target known to hurt network bandwidth.
computer. Viruses are not defined by their payloads In order for a magical worm to work, there needs
and can accomplish the same ill effects as a Trojan, to be a medium for transmission. A worm spell
but their method of self replication is what makes transfers itself from one infected target to the next
them unique. whenever an infected wizard casts a spell on another
Some viruses insert themselves into a computer’s spellcaster. This means that an infected wizard
startup sequence, while others infect a computer’s attempting to dispel the worm spell on another
runtime processes, and even more still might use a spellcaster would reinfect them at the same time as
combination of the two. When a virus inserts itself removing the infection, or reinfect himself at the
into a computer’s startup sequence it is executed at same time he attempts to dispel the worm on
boot time so, even if the damage is fixed while the himself. For this reason an infected community of
computer is running, the virus will reinfect the wizards might need to bring in outside — i.e.,
computer the next time it starts up. A virus that has uninfected — help to remove a worm.
infected a computer runtime process will be
executed every time the operating system uses the Adware
infected file, which behaves similarly to the The most annoying of malware, adware causes
previous variety of virus, except that the computer advertisements to pup up unbidden and unwelcome
can reinfect itself even while running. Both methods on infected computers. Adware usually does not
of self-replication are very clever, and make for some intentionally cause any harm to a machine but it is
PAGE 12
Black Hat Magic

not designed to be overly efficient with computer magical abilities through rigorous study, but they
resources either. Most adware is introduced to a are not unheard of and their natural aptitude for
computer when the user willingly installs software magic can make them potent members of this class.
that they did not inspect very closely and which Spell Hackers are unrivaled in their ability to
has the adware embedded within it. Many times engage in magical surveillance and therefore make
the adware will persist on the computer after the highly coveted spies (albeit very closely monitored
original software is removed and some possess a ones). They are subtle, indirect, and very hard to
very virus-like ability to avoid direct removal. predict in combat, using a mix of abilities that allow
Magical adware hitches along in the syllables of them to strike from afar and surreptitiously spread
a spell itself, and is introduced to wizards’ their spells amongst their enemies. Opponents that
spellbooks when they transcribe scrolls they rely on magic are at the most risk from a Spell
received for “free” or that they “found.” The Hacker and should always be on their guard when
advertisement may appear as an illusory image that one has taken an interest in them. Spell Hackers
appears before the spellcaster, or as a disembodied are proud and arrogant and are slow to give their
voice, and will advertise something whenever the loyalty and trust but, once they have done so, will
compromised spell is cast. Alternatively, a more go to extreme lengths for their allies.
malicious magical adware might take the form of a Role: Spell Hackers are excellent gatherers of
curse that causes advertisements to appear information and, with their abilities to infect
whenever a wizard casts any spell at all. In either opponents with spells that spread and repeat, are
case, the spell cast will likely suffer in performance, more insidious than most wizards or sorcerers. They
as some of the mage’s energy is being wasted on like to fight on their own terms, always do their
generating the advertisement. A wizard might research, and are rarely seen flinging brutish spells
transfer his magical adware to another spellcaster like Fireball.
if they share their spellbooks and allow spells to be Alignment: Becoming a Spell Hacker requires a
copied from it. fundamental commitment to breaking the rules, both
of magic and of society, and so are always nonlawful
Spell Hacker in alignment. Good spell hackers are often referred
(Pathfinder Prestige Class) to as “White Hats,” neutral as “Gray Hats,” and evil
Spell Hackers are criminals, tricksters, or sometimes as “Black Hats.”
just individuals that are interested in learning the
boundaries of magic, but in all cases they share the Hit Die: d6
desire to find and stretch the vulnerabilities and
flaws in the fabric of magic itself to achieve their Requirements
goals. These individuals are skilled arcane To qualify to become a Spell Hacker, a character
spellcasters that may have received formal training must fulfill all the following criteria.
but just as often are self taught. In either case, Alignment: Any nonlawful.
becoming a Spell Hacker requires dedication and a Skills: Spellcraft 7 ranks.
lot of patience. Spontaneous spellcasters rarely Spells: Ability to cast the arcane version of the
become Spell Hackers, as they did not come to their Scrying spell.

Table: Spell Hacker


Level Base Attack Bonus Fort Save Ref Save Will Save Special Spells per Day
1st +0 +0 +0 +1 Hacker Skill +1 level of existing class
2nd +1 +1 +1 +1 Hacker Skill +1 level of existing class
3rd +1 +1 +1 +2 Hacker Skill +1 level of existing class
4th +2 +1 +1 +2 Hacker Skill +1 level of existing class
5th +2 +2 +2 +3 Hacker Skill +1 level of existing class
6th +3 +2 +2 +3 Hacker Skill +1 level of existing class
7th +3 +2 +2 +4 Hacker Skill +1 level of existing class
8th +4 +3 +3 +4 Hacker Skill +1 level of existing class
9th +4 +3 +3 +5 Hacker Skill +1 level of existing class
10th +5 +3 +3 +5 Hacker Skill +1 level of existing class
Black Hat Magic

Special: Must be a part of the spell hacking Rootkit (Su): Once per day a Spell Hacker can
underground community. turn a magical item into a magical shortcut past a
target’s mental defenses that grants a +20 modifier
Class Skills to the DC of saves made when resisting divination
A Spell Hacker’s class skills (and the key ability for spells. This modifier only applies when the item is
each skill are) Appraise (Int), Craft (Int), Knowledge equipped and is a permanent effect until removed.
(All) (Int), Linguistics (Int), Profession (Wis), The properties of a Rootkit can be detected with an
Spellcraft (Int), Bluff (Cha), and Disguise (Cha). Identify spell and can be removed with a Remove
Curse spell (the item’s caster level is equal to the
Skill Ranks at Each Level: 2+Int Modifier. Spell Hacker’s total arcane spell caster levels). Items
that have been made into Rootkits do not radiate an
Class Features aura that is different from what would be expected
All of the following are class features of the Spell from an item of that type when subjected to a Detect
Hacker prestige class. Magic spell. This ability requires that the Spell
Hacker can see the target item and can be used when
Weapon and Armor Proficiency viewing it through divination spells such as Scrying.
Spell Hackers gain no proficiency with any weapon At 1st level a Spell Hacker can have only one Rootkit
or armor. active at a time, and creating a new one
automatically dispels the effect on the old one. This
Spells per Day/Spells Known number increases by one for every two levels of
When a character advances a level as a Spell Hacker, Spell Hacker to a maximum of five at 9th level.
he gains new spells per day as if he had also gained Creating a Rootkit takes one round per spell caster
a level in an arcane spellcasting class he belonged level of the target item and provokes attacks of
to before adding the prestige class. He does not, opportunity.
however, gain other benefits a character of that class Traceless Arcana (Su): When a Spell Hacker
would have gained, except for additional spells per casts a divination spell that would be detected by
day, spells known (if he is a spontaneous magical means, such as a Detect Scrying spell, he
spellcaster), and an increased effective level of may make a Spellcraft check to ignore the effects of
spellcasting. If a character had more than one that spell (DC 10 + caster level of the detection
spellcasting class before becoming a loremaster he spell).
must decide to which class he adds the new level Trojan Spell (Sp): A Spell Hacker can disguise a
for purposes of determining spells per day. spell he is casting to appear to be another one that
he knows. Attempts to identify the spell being cast
Hacker Special Abilities are first made as an opposed Spellcraft check. If the
As a Spell Hacker gains experience, he gains abilities Spell Hacker’s Spellcraft check is higher, reveal the
that help him subvert magic to accomplish his goals. identity of the spell being cast as though it is another
Starting at first level and every level thereafter, a known spell of the caster’s choosing. Otherwise,
Spell Hacker can pick one new Hacker Special reveal the identity of the spell as usual. This ability
Ability from the following list. can be used in conjunction with a bluff to convince
Spell Sniff (Su): A Spell Hacker can determine a target to forgo any saving throws that they would
what spells an arcane spellcaster has prepared (or normally be entitled to and in such cases counts as
are known by a spontaneous caster) with a Spellcraft “convincing proof” for purposes of determining the
check DC 10 + arcane spellcaster level of the target. bluff skill modifier. This ability can be combined
Success reveals the names of all spells and their with the Worm Spell and Virus Spell abilities and
quantities prepared by the target, while failure is useful for disguising them from targets.
reveals to the target that some sort of magical Worm Spell (Sp): Once per day at 1st level, and
infiltration has been attempted. This ability requires an additional time per day for every three Spell
that the Spell Hacker can see the target and functions Hacker levels thereafter to a maximum of four at
through divination spells such as Scrying. 10th level, a spell with a non-instantaneous duration
Skilled Reconnaissance (Ex): A Spell Hacker’s that targets a single creature can be turned into a
levels are added to the DC to resist divination spells Worm Spell. Worm Spells retain all of the original
cast on arcane spell casters. This bonus stacks with effects, durations, saving throws, etc., of the base
bonuses received from the Wizard divination school. spell but gain the ability to be spread to new targets.
Black Hat Magic

A Worm Spell propagates to another target whenever be made into a Virus Spell. Virus Spells retain all of
an infected spellcaster casts a spell on someone. the original effects, durations, saving throws, etc.,
New targets are entitled to saving throws (if any) to of the base spell, but gain the ability to become
resist the effects of the Worm Spell, and failure reactivated when certain conditions have been met.
means that they become infected and can further These spells do not immediately take effect but
spread it by casting spells on other people. Duration instead become active any time targeted spellcasters
of a worm spell is reset to its original value trigger them by casting specific spells. When casting
whenever it is spread, and it can no longer be spread a Virus Spell the Spell Hacker must declare a target
once its duration expires. Spells that have a spell for the Virus Spell to latch on to, and must be
permanent duration can be spread indefinitely until one that has been prepared by the target spellcaster
removed by Dispel Magic , Remove Curse , or other (or known by him if the target is a spontaneous
appropriate magic. This ability can be used to spread caster). If the Spell Hacker declares a spell that is
beneficial spells as well, and so might be used by a not known or prepared by the target the Virus Spell
Spell Hacker to help his party. It is also possible for fails. Otherwise, it will activate any time the target
a Worm Spell to be inadvertently spread by an casts that spell. Spellcasters infected by a Virus Spell
enemy to friendly targets unless the base spell are entitled to a saving throw or spell resistance (if
explicitly states that allies are immune. This ability appropriate for the base spell) every time it becomes
can be used in conjunction with the Trojan Spell active, but succeeding on a saving throw does not
and Virus Spell special abilities. prevent the Virus Spell from reactivating again if
Virus
irus Spell (Sp): Spell Hackers are able to create
Spell (Sp): its conditions are met. The effects of the Virus Spell
self-reproducing viral spells that bind themselves end automatically when the infected spell caster
to the magic of other arcane spell casters. Once per has cast all preparations of the infected spell (or
day, and an additional time per day for every three cast all daily spells of that spell’s level for an
Spell Hacker levels thereafter to as many as four at instantaneous caster), but will continue to affect
10th level, a spell that targets a single creature can them if they rest and reprepare the targeted spell
before casting all instances of it. The effects of a Social Engineering (Ex): As often as magic gets
Virus Spell can be removed by Dispel Magic , subverted by a Spell Hacker to achieve his goals,
Remove Curse, or other appropriate spell and can sometimes it is easier and more effective to just use
be combined with the Worm Spell and Trojan Spell mundane trickery. This ability grants the Spell
special abilities. Hacker the benefits of the Deceitful feat, and if the
Distributed Exploit (Ex): Spell Hackers are able Spell Hacker already has this feat the benefits double
to package up their hacked spells for use by people to +4 on Bluff and Disguise skill checks.
that do not have enough experience to create their Remote Execution (Sp): Using a Rootkit to
own. With this ability the Spell Hacker can apply penetrate an enemy’s defenses provides a powerful
their Virus Spell, Trojan Spell, and Worm Spell advantage and a Spell Hacker knows how to make
abilities to any spell used in conjunction with a the most out of it. Creatures in possession of one of
magic item creation feat being used by himself or the Spell Hacker’s Rootkits can be targeted by any
someone else. This does require the cooperation of spell that targets a single creature no matter where
the person being collaborated with but does not they are in the world (there is a 50% chance of
preclude deception by the Spell Crafter as to exactly success if they are on another plane). This ability
what he is doing. counts as granting line of sight for any spells that
Crew (Ex): Spell Hackers rarely work alone and require it. Touch and ray spells cast this way still
many of them actually form their own spell hacking require a touch attack to hit, but the target should
groups. This ability grants the Spell Hacker the be considered flat-footed. Targets are still entitled
benefits of the Leadership feat, even if he would to any appropriate saving throws for the spell being
normally not qualify for it, but the cohort and cast. This ability requires that the Rootkit ability be
followers attracted can only be arcane spellcasters taken first.
that are aspiring to be or have already become fellow Man in the Middle (Su): The Spell Hacker is
Spell Hackers. adept at intercepting the magical communications
Denial of Spells (Su): A Spell Hacker knows how of other spellcasters, and is even able to alter their
to overwhelm his foes with arcane energies, denying messages. Whenever a spellcaster in possession of
them their ability to cast spells for a short period of one of the Spell Hacker’s Rootkits communicates
time. Once per day at 1st level, and an additional via magical means (e.g., a Message spell), the Spell
time per day for every other level thereafter to a Hacker can listen in on the communication.
maximum of five times at 9th level, a Spell Hacker Additionally, the Spell Hacker can alter the
can, as a standard action that provokes attacks of messages being sent this way by making a Spellcraft
opportunity, prevent an arcane spellcaster from check (DC 10+level of the spell+Spellcaster’s int
casting spells for one round. The targeted spellcaster modifier), with failure meaning that those
is entitled to a Will Save (DC 10+Spell Hacker levels communicating are alerted to the magical tampering.
+ Int modifier) to avoid the effects of a Denial of This ability requires that the Rootkit ability be taken
Spells attack, but can still potentially be affected first.
by subsequent uses of the ability. This ability Brute Force (Ex): A persistent enough Spell
requires that the Spell Hacker can see the target and Hacker always gets what he wants and one with
will function through divination spells such as this special ability can always take 20 on Spellcraft
Scrying. checks if desired.
Open Game License Version 1.0.a
Version
The following text is the property of Wizards of the Coast, 6.Notice of License Copyright: You must update the COPY-
Inc. and is Copyright 2000 Wizards of the Coast, Inc (“Wiz- RIGHT NOTICE portion of this License to include the exact
ards”). All Rights Reserved. text of the COPYRIGHT NOTICE of any Open Game Content
1. Definitions: (a)”Contributors” means the copyright and/ You are copying, modifying or distributing, and You must
or trademark owners who have contributed Open Game Con- add the title, the copyright date, and the copyright holder’s
tent; (b)”Derivative Material” means copyrighted material name to the COPYRIGHT NOTICE of any original Open Game
including derivative works and translations (including into Content you Distribute.
other computer languages), potation, modification, correc- 7. Use of Product Identity: You agree not to Use any Prod-
tion, addition, extension, upgrade, improvement, compila- uct Identity, including as an indication as to compatibility,
tion, abridgment or other form in which an existing work except as expressly licensed in another, independent Agree-
may be recast, transformed or adapted; (c) “Distribute” means ment with the owner of each element of that Product Identity.
to reproduce, license, rent, lease, sell, broadcast, publicly dis- You agree not to indicate compatibility or co-adaptability
play, transmit, or otherwise distribute; (d)”Open Game Con- with any Trademark or Registered Trademark in conjunction
tent” means the game mechanic and includes the methods, with a work containing Open Game Content except as ex-
procedures, processes and routines to the extent such content pressly licensed in another, independent Agreement with the
owner of such Trademark or Registered Trademark. The use
does not embody the Product Identity and is an enhancement
of any Product Identity in Open Game Content does not con-
over the prior art and any additional content clearly identi-
stitute a challenge to the ownership of that Product Identity.
fied as Open Game Content by the Contributor, and means
The owner of any Product Identity used in Open Game Con-
any work covered by this License, including translations and tent shall retain all rights, title and interest in and to that
derivative works under copyright law, but specifically ex- Product Identity.
cludes Product Identity. (e) “Product Identity” means prod- 8. Identification: If you distribute Open Game Content You
uct and product line names, logos and identifying marks in- must clearly indicate which portions of the work that you are
cluding trade dress; artifacts; creatures characters; stories, sto- distributing are Open Game Content.
rylines, plots, thematic elements, dialogue, incidents, language, 9. Updating the License: Wizards or its designated Agents
artwork, symbols, designs, depictions, likenesses, formats, may publish updated versions of this License. You may use
poses, concepts, themes and graphic, photographic and other any authorized version of this License to copy, modify and
visual or audio representations; names and descriptions of distribute any Open Game Content originally distributed un-
characters, spells, enchantments, personalities, teams, perso- der any version of this License.
nas, likenesses and special abilities; places, locations, envi- 10. Copy of this License: You MUST include a copy of this
ronments, creatures, equipment, magical or supernatural abil- License with every copy of the Open Game Content You Dis-
ities or effects, logos, symbols, or graphic designs; and any tribute.
other trademark or registered trademark clearly identified as 11. Use of Contributor Credits: You may not market or
Product identity by the owner of the Product Identity, and advertise the Open Game Content using the name of any Con-
which specifically excludes the Open Game Content; (f) tributor unless You have written permission from the Con-
“Trademark” means the logos, names, mark, sign, motto, de- tributor to do so.
signs that are used by a Contributor to identify itself or its 12. Inability to Comply: If it is impossible for You to com-
products or the associated products contributed to the Open ply with any of the terms of this License with respect to some
Game License by the Contributor (g) “Use,” “Used,” or “Us- or all of the Open Game Content due to statute, judicial order,
ing” means to use, Distribute, copy, edit, format, modify, trans- or governmental regulation then You may not Use any Open
late and otherwise create Derivative Material of Open Game Game Material so affected.
Content. (h) “You” or “Your” means the licensee in terms of this 13. Termination: This License will terminate automatical-
agreement. ly if You fail to comply with all terms herein and fail to cure such
2. The License: This License applies to any Open Game breach within 30 days of becoming aware of the breach.
Content that contains a notice indicating that the Open Game All sublicenses shall survive the termination of this License.
Content may only be Used under and in terms of this License. 14. Reformation: If any provision of this License is held to
You must affix such a notice to any Open Game Content that be unenforceable, such provision shall be reformed only to
you Use. No terms may be added to or subtracted from this the extent necessary to make it enforceable.
License except as described by the License itself. No other 15. COPYRIGHT NOTICE: Open Game License v 1.0a Copy-
terms or conditions may be applied to any Open Game Con- right 2000, Wizards of the Coast Inc. System Reference Doc-
ument Copyright 2000–2003, Wizards of the Coast Inc.; au-
tent distributed using this License.
thors Jonathan Tweet, Monte Cook, Skip Williams, Rich Bak-
3.Offer and Acceptance: By Using the Open Game Content
er, Andy Collins, David Noonan, Rich Redman, Bruce R. Cord-
You indicate Your acceptance of the terms of this License.
ell, John D. Rateliff, Thomas Reid, and James Wyatt, based on
4. Grant and Consideration: In consideration for agreeing
original material by E. Gary Gygax and Dave Arneson. Black
to use this License, the Contributors grant You a perpetual, Hat Magic Copyright 2017, Skirmisher Publishing LLC.
worldwide, royalty-free, non-exclusive license with the exact
terms of this License to Use, the Open Game Content.
5.Representation of Authority to Contribute: If You are
contributing original material as Open Game Content, You
represent that Your Contributions are Your original creation
and/or You have sufficient rights to grant the rights conveyed
by this License.
Check out other volumes in the “Oddities” series or the Bundle with all of 9 them!

You might also like