skempertush 0 Posted October 23, 2015 Hi, If I enable PacketObfuscation, MD5 Hash, SecureGRF, Embedded Data.ini Will my server still have exploits? What are those and how to prevent them? Quote Share this post Link to post Share on other sites
0 Vy Low 11 Posted October 23, 2015 Hi, If I enable PacketObfuscation, MD5 Hash, SecureGRF, Embedded Data.ini Will my server still have exploits? What are those and how to prevent them? just host your site/server to non shared hosting and everything will be just fine Quote Share this post Link to post Share on other sites
0 Litro 45 Posted October 23, 2015 Q: Still have exploits ? A: Yes Q: What are those and how to prevent them? A: a loot to put it in detail some of them is: 1. Packet Hack, since you set packet obfuscation you could avoid it and the way to make it avail again is to tamper the client but you have set the MD5 Hash check for the client at least for minimum standart you have it already 2. Sprite edit (0 delay) it was headache if you didn't have a game guard to check the integrity of grf file 3. Macro, Bot, Visual Bot Point 2 and 3 for now you only can have a game guard to prevent it but even you have it no 100% guarante it will protect perfectly since there is always way found to fool the guard and worse it was the how to fool the guard is available in the net for free. Quote Share this post Link to post Share on other sites
0 Winterfox 83 Posted October 23, 2015 @@skempertush If you want to improve security even more, you could exchange MD5 with SHA-2 / SHA-3 and use salting when saving passwords. Quote Share this post Link to post Share on other sites
0 Garr 117 Posted October 23, 2015 (edited) Well, actually, since he'll use password protected GRF and embedded data.ini he should be safe from 0delay grf as long as a) he doesn't release his grf without pass and he doubles proper animation files inside his grf. Packet Obfuscation will make it way harder to WPE spam packets, and MD5 hash will prevent people from diffing your client further. I'd say get some more protection to prevent bots/macros, and you're pretty good to go. Edited October 23, 2015 by Garr Quote Share this post Link to post Share on other sites
0 skempertush 0 Posted October 24, 2015 Q: Still have exploits ? A: Yes Q: What are those and how to prevent them? A: a loot to put it in detail some of them is: 1. Packet Hack, since you set packet obfuscation you could avoid it and the way to make it avail again is to tamper the client but you have set the MD5 Hash check for the client at least for minimum standart you have it already 2. Sprite edit (0 delay) it was headache if you didn't have a game guard to check the integrity of grf file 3. Macro, Bot, Visual Bot Point 2 and 3 for now you only can have a game guard to prevent it but even you have it no 100% guarante it will protect perfectly since there is always way found to fool the guard and worse it was the how to fool the guard is available in the net for free. VisualBot, can it by-pass the botcheck script? Correct me if I'm wrong but. 0delaysprite.grf is still just a regular sprite, the only difference is it has NoAnimation for delay. Since MyServerGRF is secured, why not I get those WithAnimation sprites to MyServerGRF so regardless of what they would do to their data.grf it will still have it's animation because the first to read is MyServerGRF. My problem is what are those sprites.... Well, actually, since he'll use password protected GRF and embedded data.ini he should be safe from 0delay grf as long as a) he doesn't release his grf without pass and he doubles proper animation files inside his grf. Packet Obfuscation will make it way harder to WPE spam packets, and MD5 hash will prevent people from diffing your client further. I'd say get some more protection to prevent bots/macros, and you're pretty good to go. I'm also thinking about getting those WithDelaySprites on my SecuredGRF. My problem is what are those sprites... Quote Share this post Link to post Share on other sites
0 Litro 45 Posted October 24, 2015 VisualBot, can it by-pass the botcheck script? i never have visual bot, but i think visual bot can't do it againts script check, Correct me if I'm wrong but. 0delaysprite.grf is still just a regular sprite, the only difference is it has NoAnimation for delay. Since MyServerGRF is secured, why not I get those WithAnimation sprites to MyServerGRF so regardless of what they would do to their data.grf it will still have it's animation because the first to read is MyServerGRF. My problem is what are those sprites.... I'm also thinking about getting those WithDelaySprites on my SecuredGRF. My problem is what are those sprites... even you embed data.ini into your exe those way just can fool average cheater or leecher, but from what my experience from 130 player i have 15 of them can see through it this is the work around with out integrity check if the player can tell the priority of grfs he can just merge (oh yes the secureed grf is not to get extracted data but you can still merge / add file in to it) the edited sprite on the 1st grf not data grf (data.grf & rdata.grf always come last), so it will come back to check the integrity of grfs file, yes ? open patcher -> clikc start game -> compare the grf to the server if match open the exe, if not dont open it don't give the player notice about it let them think the exe was failed because their file Quote Share this post Link to post Share on other sites
0 skempertush 0 Posted October 25, 2015 VisualBot, can it by-pass the botcheck script? i never have visual bot, but i think visual bot can't do it againts script check, >Correct me if I'm wrong but. 0delaysprite.grf is still just a regular sprite, the only difference is it has NoAnimation for delay. Since MyServerGRF is secured, why not I get those WithAnimation sprites to MyServerGRF so regardless of what they would do to their data.grf it will still have it's animation because the first to read is MyServerGRF. My problem is what are those sprites.... I'm also thinking about getting those WithDelaySprites on my SecuredGRF. My problem is what are those sprites... even you embed data.ini into your exe those way just can fool average cheater or leecher, but from what my experience from 130 player i have 15 of them can see through it this is the work around with out integrity check if the player can tell the priority of grfs he can just merge (oh yes the secureed grf is not to get extracted data but you can still merge / add file in to it) the edited sprite on the 1st grf not data grf (data.grf & rdata.grf always come last), so it will come back to check the integrity of grfs file, yes ? open patcher -> clikc start game -> compare the grf to the server if match open the exe, if not dont open it don't give the player notice about it let them think the exe was failed because their file How do I integrity check on patcher? Quote Share this post Link to post Share on other sites
0 Litro 45 Posted October 25, 2015 (edited) no patcher have a feature like that for now, the only way available is using game guard OOT there is a launcher that will just (didn't have compare feature) make a file and listing all md5 files in current folder, i hope some one can make it for free release Edited October 25, 2015 by Litro Quote Share this post Link to post Share on other sites
0 skempertush 0 Posted October 26, 2015 no patcher have a feature like that for now, the only way available is using game guard OOT there is a launcher that will just (didn't have compare feature) make a file and listing all md5 files in current folder, i hope some one can make it for free release I saw the file... Yeah it will be useful if he released the source, so we can hardcode the MD5. Quote Share this post Link to post Share on other sites
Hi,
If I enable PacketObfuscation, MD5 Hash, SecureGRF, Embedded Data.ini
Will my server still have exploits? What are those and how to prevent them?
Share this post
Link to post
Share on other sites