The Matrix – Crib Sheet

Host Systems [SR3 p205]: A host is a computer system made up of 5 subsystems (Access, Control,
Index, Files and Slave, denoted ACIFS). Each subsystem has a rating that acts as a base TN for System
Operations. In addition to Subsystem Ratings the host has a Security Code (Blue, Green, Orange or
Red) and a Security Value (a number which is rolled to resist System Operations).
E.g. Red 6 (8 / 9 / 6 / 9 / 9) = Security Code, Security Value (ACIFS Ratings)
The Decker [MTX p18]: A decker usually accesses the Matrix using a cyberdeck with the simsense
interface boosted to dangerous levels, this is known as a Hot ASIST and allows access to the benefits of
Response Increase and Hacking Pool. Most deckers connect to their cyberdeck via a datajack.
MPCP and Persona Programs [SR3 p206 & MTX p20]: The MPCP (Master Persona Control
Program) is the central processing unit of the cyberdeck. Persona Programs are the deck’s “attributes”.
Legal cyberterminals use only two Persona programs, Sensor and Bod. Illegal cyberdecks also use
Masking and Evasion. The total ratings of the Persona programs cannot exceed 3 x MPCP rating.
Switching Modes [MTX p123]: A decker may bolster one Persona program at the expense of another,
increase one by 50% (rd) whilst reducing another by 50% (rd). Persona ratings may exceed the MPCP
in this manner. Changing modes requires a Complex Action.
Detection Factor [SR3 p207]: Detection Factor is used as the TN for a Host’s resistance rolls on
System operations. It is calculated as: (Masking + Sleaze) / 2 round up.
Detection Factor may have to be decreased in order to suppress crashed IC [SR3 p212].
As an Optional Rule, Detection Factor may be increased by sacrificing Hacking Pool dice (on a 2 for 1
basis) for the duration of the increase (maximum of +3) [MTX p26].
System Operations [SR3 p209]: In order to accomplish actions in the Matrix the decker will make
System Operations. All System Operations follow the same format and involve a resisted test:
Decker Rolls: Computer Skill + Hacking Pool (maximum of skill [SR3 p44])
[SR3 p210] TN: Appropriate subsystem rating – Utility rating
Host Rolls: Security Value
[SR3 p210] TN: Decker’s Detection Factor
• Interrogation Operations [SR3 p214]: When searching for a file, access node, etc a total of 5 net
successes need to be obtained, though these can be accumulated over several tests. If the data or
device does not exist on the Host this is revealed after obtaining 3 successes. Locate Slave
operations [SR3 p217] only require 3 net successes.
• Ongoing Operations [SR3 p214]: These take time, mostly dependent on the I/O Speed of the
cyberdeck. For example downloading 200 Mp of data with an I/O speed of 50 Mp per Turn will
take 4 Combat Turns.
• Monitored Operations [SR3 p215]: The decker needs to keep control by spending a Free action
each Initiative Pass in which the Decker acts. If this is not done the operation aborts.
The Security Tally [SR3 p210]: Whenever a System Operation is made the host may recognize that
an illegal intruder has performed it. Every success the host rolls on the test adds to a Security Tally
(even if the decker actually got more successes).
When the Security Tally reaches certain levels (known as Trigger Steps) the host will initiate certain
defensive action ranging from activating Intrusion Countermeasures (IC) to raising an Internal or
External Alert. Your GM will notify you when these defenses come into effect.
Tips and Tricks: The key thing in decking is to avoid cybercombat – it is time consuming, opens up
the possibility of the icon, and possibly the decker himself, getting injured, and also increases the
Security Tally quickly.
In order to avoid this it is recommended that a decker have a high Masking persona program and a high
Sleaze utility. Switch into Masking Mode at the expense of Bod to increase the Masking rating, and
thus the Detection Factor, even further.
If you are targeted by a piece of IC attempt to use the Evade Detection combat maneuver so as to avoid
cyber combat and prevent increasing the security tally by crashing the attacking IC.
 Common System Operations
Operation Test Utility Action

Control Slave (M) [SR3 p215] Slave Spoof Complex

Controls remote devices. If use of the device would normally require a special skill (e.g. Chemistry for a
chemical lab) make the system test with the average of the decker’s Computer skill and the special skill.

Decrypt Access/File/Slave [SR3 p216] Access, Files or Slave Decrypt Simple

Defeat Scramble IC on Access / SAN, files or slave devices. The subject of the scramble must be
decrypted before it can be accessed.
Download Data (O) [SR3 p216] Files Read/Write Simple
Copies files to active memory, storage memory or offline storage at the cyberdeck’s I/O Speed.

Edit File [SR3 p216] Files Read/Write Simple

Changes, creates, or deletes a file. Copying a file and placing it elsewhere on the host requires a second
test on the subsystem where the file is copied.

Edit Slave (M) [SR3 p216] Slave Spoof Complex

Modifies data sent to and from a slaved device. E.g. alter video signals sent from a security camera, or
alter readings sent to a slaved console or simulator.

Graceful Logoff [SR3 p217] Access* Deception Complex

Allows a decker to exit a host or LTG without dumpshock and clears the host’s memory of the decker’s
presence.

Locate File (I) [SR3 p217] Index Browse Complex

Finds a file on the host system. The decker must have some idea of the file he is looking for.

Locate Paydata (I) [MTX p100] Index Evaluate Complex

Finds paydata. Each net success locates 1 point of paydata.

Locate Slave (I) [SR3 p217] Index Browse Complex

Finds remote devices. The decker must have some idea of the device he is looking for. Only 3 net
successes are needed to find a Slaved device rather than the usual 5 for an Interrogation operation.

Logon to Host/LTG/RTG [SR3 p217] Access Deception Complex

Allows the decker to access a host, Local Telecommunications Grid, Private LTG, or Regional
Telecommunications Grid as appropriate. If the decker has a valid MSP account for the particular host or
grid, this test succeeds automatically [MTX p36].

Monitor Slave (M) [SR3 p218] Slave Spoof Simple

Reads data transmitted by a remote device, e.g. listen to signals from audio pickups, watch feeds from
security cameras etc.

Swap Memory (O) [SR3 p219] None None Simple*

Load new utility into Active Memory at I/O bandwidth speed. Squeezed or compressed utilities, once
uploaded, must be decompressed before they can be used; this requires a Complex Action [MTX p102].
*Unloading a program from Active Memory requires only a Free action.

Upload Data (O) [SR3 p219] Files Read/Write Simple

This allows the decker to upload files to a host directly from storage memory at a speed dependent upon
the I/O rating of the cyberdeck. If inserting the uploaded data into an existing file or database an Edit
File operation must be made following the upload.

(M) Monitored Operation (O) Ongoing Operation (I) Interrogation Operation

 Cybercombat
Decker Initiative [SR3 p223]: Deckers’ initiative is based upon their normal Reaction (unless using
Pure DNI, when Matrix Reaction equals Intelligence [MTX p18]) and adjusted for method of control
[MTX p17 & 18] and Response Increase [SR3 p207]. If a decker is in direct communication with the
physical world he loses 1D6.

Actions [SR3 p223]: The following list describes the actions a decker can take in cybercombat, in
addition to System Operations.
Free Actions: Simple Actions:
• Delay Action • Attack.
• Jack Out - unless successfully attacked by • Perform Combat Maneuver.
Black IC • Improvise an Attack [MTX p122] (see below)
• Speak a Word (reduces Initiative by D6)
• Buffer message to the real world. Less than Complex Actions:
100 words, received at the end of the turn. • Change deck modes [MTX p123].
• Terminate or Suspend an up / download. • Jack Out if successfully attacked by Black IC
• Erase a program from Active memory. [SR3 p230].
• Unsuppress IC.

Attack [SR3 p224]: Roll: Offensive utility rating + Hacking Pool (max of skill [SR3 p44])
OR Security Value
TN: See table below, modified per Combat Maneuvers.
Security Code TN to Hit TN to Hit
[SR3 p226] Intruding Target Legitimate Target
Blue 6 3
Green 5 4
Orange 4 5
Red 3 6

Shield Parry [MTX p74]: When the decker with a Shield utility is attacked they may attempt to parry:
Roll: Shield utility rating
TN: Attacker’s Computer skill
OR the Security Value if attacked by IC
Each success cancels an Attack success. A Shield utility degrades by 1 point each use (whether it was
successful or not). New copies can be loaded into memory if needed.

Improvised Defense [MTX p122]: Deckers can also put up an improvised defense,
Roll: Hacking Pool (max of Computer skill)
TN: Half the attacker’s Computer skill
OR Half the Security Value if attacked by IC
Each success cancels an Attack success. If all Attack successes are cancelled the Attack is blocked.

Damage [SR3 p226]: If the attack inflicts damage, the base damage level is staged up by one level per
2 net Attack successes.
The victim resists damage:
Target Roll: Bod OR Security Value
[SR3 p226] TN: Power of attack OR IC rating, less Armour utility
Simsense Overload [SR3 p226]: If a decker’s icon takes damage from White or Grey IC he takes a
Light stun wound if he fails a Willpower test:
Decker Roll: Willpower
[MTX p122] TN: 2 if icon took Light damage
3 if icon took Moderate damage
5 if icon took Serious damage

Dump Shock [SR3 p227]: When the decker’s icon crashes, or if he jacks out without performing a
Graceful Logoff, he takes stun damage, resisted with Willpower.
Power: Host/ Grid’s Security value
Level: Light if Blue
Moderate if Green
Serious if Orange
Deadly if Red.

Improvising an Attack [MTX p122]: A one-shot Attack program can be improvised using a Simple
action (a separate Simple action is required to use the program).
To determine the improvised attack rating the decker must allocate Hacking Pool dice on a 1 for 1
basis, to a maximum of Computer (Programming).
To determine the Damage level of the improvised attack the decker must make the following test,
compare the successes to the chart below:
Decker Roll: Computer (Decking)
[MTX p122] TN: Security Value of host system
Successes Damage Level of
[MTX p122] Improvised Attack
1 Light
2 Moderate
3 Serious
4+ Deadly

Combat Maneuvers [SR3 p224]: To perform a combat maneuver the icon must win an opposed test:
Maneuver Roll: Evasion OR Security Value, plus Hacking Pool
[SR3 p224] TN: Opponent’s Sensor OR Security Value, less Cloak utility
Opposed By Roll: Sensor OR Security Value, plus Hacking Pool
[SR3 p224] TN: Opponent’s Evasion OR Security Value, less Lock On utility
• Evade Detection [SR3 p224]: If the maneuver is successful the opponent needs to make a Locate
Decker, IC etc. operation to re-detect the evading icon.
IC will re-detect an evading decker in a number of turns equal to the net successes in the maneuver
test, less additions to the Security Tally which occur during that period. The IC shows up at the
end of last turn of the evasion period.
• Parry Attack [SR3 p225]: Increase the opponent’s TN to attack the parrying decker or IC by the
net successes on the maneuver test. The bonus lasts till the next attack by the opposing icon, or
until either party performs an Evade Detection maneuver.
• Position Attack [SR3 p225]: If successful, the positioning icon can either receive a reduction to
his attack TN equal to the net successes, or an increase to the Power of his attack equal to the net
successes. If the test fails the opposing icon receives the bonus. The bonus lasts until the next
attack.

Suppressing IC [SR3 p212]: When a piece of IC has been destroyed, or relocated in the case of Trace
IC [MTX p100], it must be suppressed from alerting the Host or continuing its trace. Each piece of IC
suppressed either reduces the decker’s Detection Factor or Hacking Pool [MTX p26] by 1 point.