The title line of each action gives the name of the action, whether it is Legal or Illegal, what kind of access you need to attempt the action (either Outsider, User, or Admin), what kind of test you need to make to perform the action, and what kind of action it is (Minor or Major).

Hacking actions are explicitly tests involved in the Probe and Brute Force Matrix Actions.

Where two different dice pools are listed, such as “Intuition + Firewall or Sleaze + Firewall,” personas with Mental attributes use the pool with those attributes. Drones use their Pilot Rating in place of the Mental Attribute. 

A persona actively defending for a device or host can use the other pool with the device or host attributes.

Buying Hits

Sometimes a player does not want to trust the vagaries of the dice, and they feel that they have a large enough dice pool and an easy enough task that they can buy hits instead of rolling dice. To buy hits, you form your dice pool and calculate 1 hit for every 4 dice, rounded down. This is an all-or-nothing move - you either buy hits with all your dice or with none. Edge cannot be used in any way when buying hits, and you need gamemaster approval to buy hits. It should not happen in a circumstance where a Glitch or Critical Glitch would have a significant impact on the test’s outcome.

No Test

Access Required: User/Admin

You change the target’s icon to one that you have a copy of or have designed yourself. 

Changing an icon doesn’t change the results of a Matrix Perception action but might fool personas who don’t take the time to inspect your new look. 

You can target your own icon, if you like.

No Test

Access Required: Depends on Host settings

You enter or leave a host. No test is required, but different hosts have different access levels, so you must have the appropriate access to enter. 

Leaving can be done without any particular access level, because the Matrix is always happy to see interlopers leave.

No Test

Access Required: Admin

Swap the base ratings of two non-zero attributes of your Matrix Persona, even if the numbers are rooted in different devices. 

See Personas and Attributes (p. 174, SR6 core) for more information on Matrix Attributes, and the Matrix Attribute Adjustments sidebar (p. 178, SR6 Core) for an example.

No Test

Access Required: Outsider/User/Admin

You send a text or audio message the length of a short sentence, an image, or a file via the Matrix to a user whose commcode you have. 

If you’re using the Matrix through a DNI, even if you’re in AR, you can send longer and more complicated messages, about a paragraph worth of text. You can also use this action to open a live feed to one or more recipients, using any digital recording devices you have.

No Test

Access Required: Admin

You switch your interface from AR to VR, or vice versa.

Electronics + Logic vs. Intuition + Sleaze OR Sleaze x 2

Access Required: Outsider

A successful Squelch test prevents the target device from calling or sending messages for a number of minutes equal to the net hits scored.

No Test

Access Required: Outsider

A decker or technomancer gains a +1 Dice Pool Modifier with the use of this action from studying their target’s defenses. 

The action can only be taken once per Combat Round, and the bonus is carried over to the next round if unused until they fail to use a Virtual Aim action on that round or if they attack. 

The maximum dice pool bonus from the use of this action equals the character’s Willpower. 

The bonus can be applied to any Matrix attack action such as Data Spike, Tarpit, or Resonance Spike.

Cracking + Logic vs. Willpower + Firewall

Access Required: User/Admin

Target must be a persona or device. The number of net hits is how many combat rounds the program stays active. If successful, the player can see what the target is doing on their devices. 

The user is now aware of the Matrix Actions the target is going to use before they use them, and they may attempt to stop them. Watchdog allows the hacker to use Threat Analysis as a minor action if the attack originates from the target.

Cracking + Logic vs. Willpower + Firewall

Access Required: Outsider

You attempt to use a backdoor you have put in place to gain illicit entry into a host, device, or other Matrix area. This action can only be used if you have previously used Probe on the target successfully; net hits from that successful Probe count as a dice-pool bonus on this test. 

If the test is successful, you gain Admin access to the target, and it does not count as illegal Admin access (though taking illegal Matrix Actions will still increase your Overwatch Score). 

If this test fails, the backdoor you have made was detected and removed, and you cannot attempt Backdoor Entry again with the same host until a new backdoor is made through the Probe Action. Failing this test does not immediately set off alarms, but the character’s OS increases as normal.

This action is linked to the Sleaze Attribute. 

Cracking + Logic vs. Willpower + Firewall

Access Required: Outsider/User/Admin

You directly attack a device, flooding it with requests, commands, queries, and other junk code in order to create an exploit to give you access. Brute Force is by far the fastest way to gain illicit access to a device, but it carries with it many risks. Using Brute Force will always alert the device you are attempting to gain access to, so GOD score accumulates with each test. Should you fail a Brute Force attempt to gain access, you may attempt another on the next combat round.

If the hacker is attempting to gain User or Admin access, the opposed roll is Willpower + Firewall. When attempting to gain Admin access without first having gained User access, the opposed roll is Willpower + (Firewall + 2), and the target is granted a +4 Dice Pool Bonus to that for that Test.

This action is linked to the Attack Attribute. 

Cracking + Logic

Access Required: User/Admin

You lend your team your own processing power and boost their speed. You can increase the current Initiative Score of you and your team by 1 for every 2 hits. 

The total amount of Initiative Score increase granted to a persona cannot be greater than your Data Processing, and only one Calibration effect can be active at a time. 

The Initiative Score then decreases by 1 each Combat Turn until it returns to the normal initiative score.

This bonus applies to anyone with an AR feed that shares the decker’s PAN. The hacker can only share their feed with a number of users equal to or less than their device rating.

Cracking + Logic (4)

Access Required: Admin

If your test is successful, you are informed of your current Overwatch Score.

Electronics + Logic vs. Willpower + Firewall

Access Required: User/Admin (can vary by action)

This action allows extended remote control of a device. You maintain control until you relinquish command or are forced out of the system. While you have control, you can use the device as if you were the owner using a standard skill test, including turning the device off if you have Admin access. If there is no test associated with the device you wish to use, use Electronics + Logic vs. Firewall + Willpower. This test assumes you are using the device directly, not commanding a device to use another (such as commanding a drone to fire its weapon). 

A Control Device action versus a device currently “jumped into” by a rigger automatically fails.

When you use Control Device, you may take any action that would normally require the level of access you currently have. Hacking User access allows you to take any action that would normally require legitimate User access. Actions that normally require legitimate Admin access will likewise require hacked Admin access to perform.

Cracking + Logic vs. (Encryption Rating x 2)

Access Required: User/Admin

You remove the protection from a file, making it readable.

Cracking + Logic vs. Data Processing + Device Rating

Access Required: Admin

You overload part of your target’s memory and scramble one of its running programs. You need to specify which program you’re trying to crash; you can learn what your target is running either with a Matrix Perception action or by observing the program in action. 

If you succeed, the program is scrambled: it ends and cannot be restarted until the device it was running on is rebooted.

Cracking + Logic vs. Data Processing + Firewall

Access Required: Outsider/User/Admin

You send harmful instructions to a persona or device, causing Matrix damage to the target. Your attack has a Damage Value equal to your [Attack Attribute/2, rounded up], with one additional box of damage per net hit.

This action is linked to the Attack attribute.

Cracking + Logic vs. Data Processing OR Pilot + Firewall

Access Required: Outsider/User/Admin

You send a payload to a device that contains a command and time delay that the target perceives as coming from its owner. The device then automatically attempts to perform the action when the time delay is passed. 

On success, the command will execute even if the host turns off their wireless functionality. 

If the device is rebooted before the command executes, the delayed command is lost.

Electronics + Logic vs. Willpower + Firewall

Access Required: Outsider

Wireless devices become nearly unusable when you pollute their data streams with noise. 

A decker or technomancer may target a wirelessly active device or persona. Make an Electronics + Logic vs. Willpower + Firewall Opposed test and apply the number of net hits x 2 as a negative dice pool modifier to all tests made with that device until the end of the next combat round.

Cracking + Logic vs. Willpower + Firewall

Access Required: Outsider/User/Admin

Sometimes the easiest way to get away from a hack is to just turn off your wireless. The attack targets a device, and on success prevents the device from going offline for a number of rounds equal to net hits. 

Once the number of rounds has expired, the decker or technomancer can spend a Minor Action to extend the device lock by a round. This extension can only be done once.

Cracking + Logic vs. (Data Bomb Rating x 2)

Access Required: Outsider/User/Admin

You attempt to disarm a Data Bomb that you have detected (usually as the result of a Matrix Perception action). If you score any net hits, the Data Bomb is removed and deleted. 

If not, the Data Bomb activates, causing its damage and possibly destroying any file to which it was attached (assuming it was set to destroy the file).

Electronics + Logic vs. Intuition + Firewall or Firewall + Sleaze

Access Required: User/Admin

Edit File allows you to create, change, copy, delete, or protect any kind of file. The defender is either the host holding the file or the owner of the file (if it’s not on a host). Each action is enough to alter one detail of a file - a short paragraph of text, a single detail of an image, or two or three seconds of video or audio (you and your GM can work out what exactly “one detail” means). 

Your GM may impose penalties on the test if your edit is particularly intricate or tricky. If you want to perform a continuous edit, such as removing your teammates from a video feed, you need to perform this action once per combat round for as long as you want to keep the edit going. 

If you use this action to copy a file, you are the new file’s owner. If the file you want to copy has protection on it, this action automatically fails. If the file has a Data Bomb, the Data Bomb goes off on you (so try to remember to scan files before you open them).

Electronics + Logic

Access Required: User/Admin

The hits on the Encrypt File test establish an Encryption Rating that’s used to oppose future Crack File attempts.

Electronics + Logic vs. Willpower + Firewall or (Firewall x 2)

Access Required: User/Admin

You eradicate a Matrix signature that has been left by a Resonance being, such as a technomancer or a sprite. If the test is successful, the signature dissipates. You must have a Resonance rating to attempt this action.

Unlike other actions that need Resonance, this one’s a real Matrix Action, and illegal to boot, so you risk Matrix damage and Overwatch Score when you use it.

Electronics + Logic vs. Willpower + Firewall or (Firewall x 2)

Access Required: Admin

You rewrite the boot code of the target device. The next time it would reboot, it instead shuts down for good, or until its software can be replaced. A device that has been shut down in this fashion loses all of its wireless modifiers but can still be used as a normal mechanism (a door with a manual handle can be opened, a gun with a trigger can be fired, etc.), and it cannot be accessed from the Matrix. 

Repairing a formatted device follows the same rules as repairing a bricked device (see Bricked Devices, pg. 175 SR6 Core), requiring a number of hits equal to the device’s Device Rating to restore the corrupted boot code.

See Description

Access Required: Outsider/User/Admin

This action is the Matrix equivalent of Full Defense.

Until the end of the combat round, add your Firewall to all Matrix-based defense tests. This is an Anytime action that may be taken outside your turn.

Cracking + Logic vs. Willpower + Firewall

Access Required: User/Admin

This command allows the decker to “cross the wires” of a single device, confusing some of the inputs and outputs of the system. 

A single input can be rerouted to execute a different command. For example, a commlink could have its call function altered to automatically delete the contact information of the person that its user intended to call. A camera could switch the rewind function with that of the fast forward function. 

The command can’t override the basic safety features of the device or system, and the gamemaster has final say in what can be accomplished with the command.

Electronics + Logic

Access Required: User/Admin

This is a specialized Matrix search, made illegal by the fact that it searches for an encrypted file by matching it to a hash value (GOD does not appreciate people trying to skirt encryption). By searching for a specific value, the characters can find an encrypted document on a host or device without first having to decrypt every document to find the right one. This works best if Mr. Johnson provided the hash value to them, but in a pinch the search can be done with the character’s best guess.

The threshold is 1 if you have a hash value from Mr. Johnson or some other source, 4 if you are doing the best on your own. Meeting the threshold means you have narrowed the number of possibly matching files down to 32; for every net hit, that number is divided in half (so there are 16 files with 1 net hit, 8 with 2, etc.).

If the number of possible matches still seems too large after the initial test, the test can be repeated with the -2 dice pool penalty for repeating an action (see p. 36). Success on this subsequent test, along with any net hits, serves to divide the number of possible matches in half.

Cracking + Intuition vs Intuition + Data Processing or Data Processing + Sleaze

Access Required: Outsider/User/Admin

When you muck about in the Matrix, you’ll probably be spotted by another icon, even if you’re running silent. You can use this action to make a target lose you. 

If you succeed, the target stops spotting you and needs to perform a new Matrix Perception action against you if it wants to find you again. 

You can’t hide from an icon that has gained User or Admin access to anything in your network.

Electronics + Willpower vs Charisma + Data Processing or Attack + Data Processing

Access Required: Outsider/User/Admin

This action jacks you out of the Matrix and reboots the device you are using. 

You suffer dumpshock if you were in VR. 

The defense pool only applies if you’ve been link-locked by someone; the test is against the icon that locked your link. If more than one persona has you link-locked, you need to beat each of them individually: use a single roll and compare your hits to rolls from each opponent who had established a link-lock. 

You can only jack out yourself. 

You can’t dump other people except by beating them into submission through Matrix damage.

Cracking + Logic

Access Required: Outsider/User/Admin

This action turns the wireless device you are using into a local jammer. 

As long as you do not use the device for any further Matrix actions, the device adds any hits you get on the test to the noise rating for all Matrix actions conducted by or targeting any devices within 100 meters.

If you want selective jamming or directional jamming, buy a jammer - that’s what they’re for.

Electronics + Logic vs Willpower + Firewall or (Firewall x 2)

Access Required: User/Admin

You jump into a device that has a rigger adaptation, usually a vehicle or a drone. There’s a list of things you need to have in order to jump into a device: you have to have the proper access level on the device you want to jump into, you have to be in VR, the device you want to jump into has to have a rigger adaptation, and you have to have a control rig. 

If you are the device’s owner, or the device’s owner has given you permission to jump into the device, you don’t need to make a test. 

In the Matrix, the icon of the device you jumped into becomes part of your persona and it cannot be targeted by matrix actions while you are jumped in. If someone else is currently jumped into the device, you cannot attempt this action.

Cracking + Logic vs. Willpower + Firewall OR Firewall x 2

Access Required: Outsider/User/Admin

This action is linked to the Sleaze Attribute. 

You attempt to run through a set of previously known exploits in order to gain illicit entry into a host, device, or other Matrix area. This action does not require a previously successful Probe, but against a fully patched host is going to be less likely to be successful. 

Runners performing this action are unable to spend Edge. 

In addition, the host or device gains a point of Edge that is either spent immediately on that action or disappears. 

If the test is successful, you gain Admin access to the target, and it does not count as illegal Admin access (though taking illegal Matrix Actions will still increase your Overwatch Score). 

Failing this test does not immediately set off alarms, but the character’s OS increases as normal.

Cracking + Logic vs. Intuition + Data Processing

Access Required: Outsider

This action allows a hacker to impersonate a persona on the Matrix. Since persona data is updated in real time, this action is difficult to execute successfully. 

For every net hit scored on a Cracking + Logic vs. Data Processing + Intuition, you convince Matrix systems and casual observers that you are the target for one minute. 

This can be used to impersonate someone online, intercept their calls, use their social media, rummage through their email history, or otherwise create mischief, but processes like changing device owners or performing major financial actions (like bank transfers) have too many double-checks for Masquerade to work. 

If the persona you’re impersonating logs off, the disguise drops. While masquerading, you are never considered the owner with regard to any of the impersonated persona’s devices.

Electronics + Intuition vs. Willpower + Sleaze

Access Required: Outsider/User/Admin

A successful test gives you information about the target. 

With a tie, you can perceive the item’s icon. A single net hit will give you basic information, such as device rating, or whatever name the device or icon calls itself. Two net hits will give you more specific information, including individual attribute ratings, and what programs it is currently running. Additional hits will give you more information based on what the GM wishes to reveal. 

This test can also be used to attempt to spot any icons in the vicinity that are running silent.

Electronics + Intuition (Extended, 10 Minutes)

Access Required: Outsider/User/Admin

Search the publicly accessible grid for information. The number of hits generated gives you more information regarding the subject.

Cracking + Logic vs. Intuition + Data Processing

Access Required: Outsider

This command inserts you in between any calls or Matrix actions that go into or out of a device. 

On a successful test, all communications bounce through your device for minutes equal to net hits.

Electronics + Logic vs. Intuition + Data Processing OR Data Processing + Sleaze

Access Required: Admin

Sometimes you want your Ares Predator VI’s Matrix icon to look a little less threatening.

 This action allows a hacker to change a Matrix icon to look like a different icon. Each time your icon is scanned, you need to make an Electronics + Logic vs. the scanning device’s Data Processing + Sleaze or device operator’s Intuition + Data Processing to not be detected.

Cracking + Logic vs. Intuition + Data Processing

Access Required: Outsider

It’s so irritating when your entire display or view is completely blocked by popup AROs or windows that prevent you from doing what you intended. 

The decker or technomancer attempts a Cracking + Logic versus Intuition + Data Processing Opposed test against a target device or persona. 

The targeted device or persona is unable to spend Edge for a number of combat rounds equal to net hits.

Cracking + Logic vs. Willpower + Firewall or (Firewall x 2) (Extended, 1 Minute)

Access Required: Outsider/User/Admin

You probe a network for weaknesses, looking to gain access. By taking your time not to alert any security to your presence, you can create an exploit that may last until you are ready to use it. While not as fast as using Brute Force, Probing a network does not raise an alarm automatically. Even if your attempt initially fails, it will not trigger an alarm unless you Glitch. A successful Probe creates a backdoor in the system to exploit.

Once you create the exploit, you may then use the Backdoor Entry action at a later time. Net hits on this test count as a dice pool bonus on your future Backdoor Entry test. 

The duration of these backdoors depends on the PAN or host - most systems create a changelog and will automatically correct and report differences to their configurations caused by the presence of these exploits. 

Generally speaking, the backdoor lasts for [10 - Host/Device Rating] hours or until you go offline. 

This action is linked to the Sleaze attribute.

Electronics + Logic vs. Willpower + Firewall or (Firewall x 2)

Access Required: Admin

The target device, persona, or PAN goes offline and comes back online at the end of the following combat round. 

The target’s Overwatch Score and any access achieved on or by the target is reset. 

No dumpshock occurs from rebooting. 

You cannot reboot if you are link-locked.

Electronics + Logic vs (Device Rating x 2)

Access Required: Admin

You set a Data Bomb in a file. Choose the rating of the Data Bomb, up to the net hits on your test. You also need to choose whether or not the Data Bomb will delete the file to which it is attached when activated, and the passcode required to deactivate it. A file can only have one Data Bomb on it at a time.

The Data Bomb is triggered when someone attempts to read, edit, copy, protect, delete, or place another Data Bomb on the file without disarming the Data Bomb that’s already in place. When a Data Bomb goes off, it causes (Rating x 2) Matrix Damage (resisted with Willpower) to the icon that tripped it, deletes the file (if it was set that way), and then is itself deleted. If the passcode is used, the Data Bomb doesn’t activate. Instead, it remains attached to the file, waiting for the next guy.

A Data Bomb can be detected using Matrix Perception. If it’s detected, it can be defused with the Disarm Data Bomb action; a disarmed Data Bomb is deleted.

Cracking + Sleaze vs. Firewall + Willpower

Access Required: Admin

This action allows you to redirect the gaze of GOD temporarily from your persona to another. When this action is performed, if the initiator scores any net hits, their Overwatch Score is transferred to the target persona for (net hits) turns. 

This action may only be performed while in a host. It must target another persona present in the same host.

The host must have a demiGOD. At the end of the final turn, all Overwatch Score returns to its original possessor, and any points gained since the action was successfully performed are added to it. 

If the target persona is aware of your presence, they may spend a Minor Action to add Data Processing to the opposing roll.

Cracking + Logic vs. Logic + Firewall or Data Processing + Firewall

Access Required: Admin

This action lets you intercept Matrix traffic sent to and from your target for as long as you have access. 

You can listen to, view, or read this data live, or you can save it for later playback/viewing if you have something to store it on (your deck or commlink will do).

Cracking + Logic vs. Data Processing or Pilot + Firewall

Access Required: Admin

You send a signal to a device with a command the target perceives as coming from its owner. 

The device then automatically attempts to perform the action as its next available major action.

Cracking + Logic vs. Data Processing or Pilot + Firewall

Access Required: Admin

This action allows a decker or technomancer to slightly alter the operation of multiple physical devices so they respond to the hacker’s commands. 

If the hacker has at least Admin access on the host, a successful Electronics + Intuition vs. Intuition + Firewall or 2 x Firewall test allows them to control one group of similar simple devices (traffic lights, vending machines, home appliances, desk lamps, etc., at GM discretion) slaved to that host for every net hit. This action cannot be used to make an attack. 

The hacker can sustain controlling these devices as a Major Action each combat round.

Cracking + Logic vs. Data Processing + Firewall

Access Required: Outsider/User/Admin

Sometimes you want to deliver as much hurt as possible; sometimes you want to deliver a little pain and a little slowness, in order to make the rest of your blows land easier. 

If you succeed in making this attack, do (1 + net hits) damage to the icon you attacked while also reducing their Data Processing rating by the same amount. If a device’s Data Processing rating is reduced to 0, the user cannot perform a Matrix action until it is 1 or more. 

The Data Processing rating recovers at a rate of 1 point per combat round.

This action is linked to the Attack attribute.

Electronics + Logic

Access Required: Outsider/User/Admin

Instead of attacking, the hacker engages threat-highlighting software, giving allies an edge to their defenses. 

Threat Analysis allows the hacker to give a Defense test bonus to all allies with access to an AR feed. The number of bonus dice equals the number of hits on an Electronics + Logic test. 

This bonus lasts until the beginning of the hacker’s next turn. 

This bonus applies to anyone with an AR feed that shares the decker’s PAN. 

The hacker can only share their feed with a number of users equal to or less than their Data Processing.

Electronics + Intuition vs. Willpower + Sleaze or Firewall + Sleaze

Access Required: Admin

You find the physical location of a device or persona in the Matrix. After succeeding with this action, you know the target’s location for as long as you can detect the target. 

This doesn’t work on IC or hosts that have no physical location, but it does work on offline hosts with physical hardware (although if you can access one of those to trace it, you probably know where it is already).