The coolest hack I've seen yet is the one that injects scripts. It's kind of hard to bring the client Anti-Hack up to date though when we're still stuck on V5.
This "insecure" code:
PHP Code:
function onActionServerSide() {
if (params[0] == "levelup") {
clientr.level++;
}
else if (params[0] == "setclass") {
clientr.class = params[1];
}
}
To "secure" it you should be adding exp on the server-side, checking the exp against their exp needed, and leveling up there instead of relying on a client-side system and sending a trigger to increase the level.
You would also make sure the class they pick is in the list of valid classes, and that they don't already have a class.
Server-side verification is a must wherever (I.e: Web Apps) you go though, clients are inheritly insecure.
Honestly though the hacking problem on Graal isn't
that bad. The recurring wall-walking and freeze hacks are easily detected.