Gani Cheat Security

[ffcmike]

Some server staff may or may not be aware of a particular exploit that the knowledge of which seems to have been spreading quite recently, all it involves is the modification of a servers gani within your offline folders to work as a type 2/movie gani, the effect this has it that the location the player is displayed is somehow synced with the true player x/y variable, even I didn't believe it when it was explained to me at first as it defies my understanding of how ganis work, I guess it does by some form of quirk.

The example that I am referring to was the modification of the grab gani, which would first move the player back and forth in all directions, then repeat this diagonally allowing the user to simply move once in their intended position.

As it happens this problem is fixed within the V6 client, but I've seen it done a couple of times throughout the last week so decided to try and prevent it by script, it turned out to be quite simple so I've turned it into a self-contained weapon script (as Classic has a pretty complex security system that I have this tied into) for general use:

PHP Code:

function onActionServerSide(temp.ani){
  temp.message = "Player " @ player.account @ " was caught Gani modifying (" @ temp.ani @ ").";
  sendtorc("/disconnect " @ player.account @ " " @ char(34) @ "Security has detected and logged a suspected Gani exploit from your client." @ char(34));
  this.logHack(temp.message);
}

function logHack(temp.message){
  sendtorc(temp.message);
  savelog2("log_security.txt", temp.message);
}

//#CLIENTSIDE
function onCreated(){
  //List of exceptions incase a server actually does use a movie gani on the player, otherwise remove
  this.exceptions = {
    "moviegani1",
    "moviegani2",
  };
  this.setTimer(1); //Doesn't necessarily have to be every second, also shouldn't be called immediately as logging back in could re-trigger it.
}

function onTimeout(){
  if(player.ani.movie){
    //Remove if no exceptions
    if(this.exceptions.index(player.ani.name) == -1){
      triggerserver("gui", this.name, player.ani.name);
      return;
    }
  }
  this.setTimer(1);
} 


Ofcourse in the event of a server actually using a movie gani on the player that could mean modifying that gani would go un-detected, something like this however could have the added checks of player.x and y changing compared to the old value to atleast log the possibility.