Protecting from hackers

[Yen]

Alright..
To reduce some stress on the server, I'm calculating damage on the clientside. If you're going to reply 'Do it serverside,' just don't.

Anyway, I have a GetDamage(arg) function. arg is a list of 'modifiers' to include in the attack (i.e. 'range' will return the possible damage range, 'noweapon' will return the player's damage with no weapon equipped)

Once damage has been calculated, I did this:

PHP Code:

temp.dmcheck = temp.dmg-1;
temp.dmg--;
if (temp.dmcheck != temp.dmg) return "HACKER";
temp.dmg++; 


However, it's randomly returning 'HACKER' even though the person isn't hacking. Any ideas?

[excaliber7388]

what is the variable for damage?
plus you subtract 2 from temp.dmg and so it will never == temp.dmcheck

[Mark Sir Link]

Originally Posted by Yen

Alright..
To reduce some stress on the server, I'm calculating damage on the clientside. If you're going to reply 'Do it serverside,' just don't.

Anyway, I have a GetDamage(arg) function. arg is a list of 'modifiers' to include in the attack (i.e. 'range' will return the possible damage range, 'noweapon' will return the player's damage with no weapon equipped)

Once damage has been calculated, I did this:

PHP Code:

temp.dmcheck = temp.dmg-1;
temp.dmg--;
if (temp.dmcheck != temp.dmg) return "HACKER";
temp.dmg++; 


However, it's randomly returning 'HACKER' even though the person isn't hacking. Any ideas?

Good job Excaliber, you don't know how to code!

the temp.dmcheck = temp.dmg-1 never modifies temp.dmg
temp.dmg than has a post decrement of one which causes the temp.dmcheck to = temp.dmg

[excaliber7388]

Originally Posted by Mark Sir Link

Good job Excaliber, you don't know how to code!

the temp.dmcheck = temp.dmg-1 never modifies temp.dmg
temp.dmg than has a post decrement of one which causes the temp.dmcheck to = temp.dmg

Hmmm i thought it set it to the value on the other side of the equals sign
However, you're definatly right,

the temp.dmcheck = temp.dmg-1 never modifies temp.dmg

Brain fart, sorry
Anyway, I can't see why it would return hacker, it doesn't make sense.
I'm not sure, but can hackers modify temp variables?
If so, this check yould be useless anyway. It may be better to calculate the damage, twice, and compare values at the end, although this would take double the script time.

[ApothiX]

Have you tried doing a pre-decrement of the temp.dam variable? I don't really think that it would matter, but it's worth a shot I guess. (pre-decrement is: --temp.dmg

Also, try echoing temp.dmg and temp.dmcheck, and see if they really are not the same.

[MegaMasterX90875]

Hm, Measuring damage only? It should be measuring HP too (For those God Modders who are just asking for a ban) to double up on security.

[Sage_Shadowbane]

Excalibur...Dont try posting in the scripting section please.. Variables can only be accessed by the NPC itself, not by a client. Also MegaMaster...you have a good idea, except it doesnt have anything to do with Yen's question.

Yen, what check are you doing prior to the setting of temp.dmcheck?

[excaliber7388]

Originally Posted by Sage_Shadowbane

Excalibur...Dont try posting in the scripting section please.. Variables can only be accessed by the NPC itself, not by a client.

Ah, yes, learning is so bad.

[Yen]

I've already got it testing stats; that works fine.

I'm doing a lot above the check.. But it shouldn't effect anything. :/

[excaliber7388]

I'm no expert, but it sems to be scripted perfectly

[Andy0687]

This might seem like the most simple silly suggestion ever, but put the conditional statement into brackets. Odd as it is sometimes this will fix random conditions from checking out wrong (interpreter problem?). Had it happen to me before.

[Rick]

Simple, just disable 2.x from your server and you don't have to worry about crap like that.

[Yen]

Originally Posted by Rick

Simple, just disable 2.x from your server and you don't have to worry about crap like that.

They're on v4.
They simply modify freeze the values; it took barely 5 seconds for them to do.

[Tyrial]

Hmm..

Lets say temp.dmcheck = 10
and temp.dmg = 10.

temp.dmcheck = temp.dmg-1; //This part will make temp.dmcheck into temp.dmg(10)-1. dmcheck is now 9 and dmg is still 10.

temp.dmg--; makes it 9.

So what you do is to remove 1 from temp.dmg and temp.dmcheck.
So what you did is the same as doing:

temp.dmg--;
temp.dmcheck = temp.dmg;


right?

Correct me if I'm wrong.

[Bl0nkt]

Are you sure they are both equal? Why don't you have it list those two values somewhere?

[Admins]

Just print them (with echo()) to know if they are really the same, if the script only has those 3 lines then it should never display the hacker thing.

[ApothiX]

Originally Posted by Sage_Shadowbane

Excalibur...Dont try posting in the scripting section please.. Variables can only be accessed by the NPC itself, not by a client.

Clientside variables can be accessed by anything that can read the memory.

Originally Posted by Tyrial

Hmm..

Lets say temp.dmcheck = 10
and temp.dmg = 10.

temp.dmcheck = temp.dmg-1; //This part will make temp.dmcheck into temp.dmg(10)-1. dmcheck is now 9 and dmg is still 10.

temp.dmg--; makes it 9.

So what you do is to remove 1 from temp.dmg and temp.dmcheck.
So what you did is the same as doing:

temp.dmg--;
temp.dmcheck = temp.dmg;


right?

Correct me if I'm wrong.

It's the point that he's doing both of them separately. Makes it more elusive for hackers to catch.

[Bl0nkt]

Originally Posted by Stefan

Just print them (with echo()) to know if they are really the same, if the script only has those 3 lines then it should never display the hacker thing.

Stop copying me. >:[

[ApothiX]

Originally Posted by Bl0nkt

Stop copying me. >:[

Exquooze me?

Originally Posted by ApothiX

Have you tried doing a pre-decrement of the temp.dam variable? I don't really think that it would matter, but it's worth a shot I guess. (pre-decrement is: --temp.dmg

Also, try echoing temp.dmg and temp.dmcheck, and see if they really are not the same.

[Yen]

The script wasn't fully updating on players (wtf?) when I updated it in RC. It was returning the check as 0.
Once they restarted Graal, it worked fine.

[ApothiX]

Originally Posted by Yen

The script wasn't fully updating on players (wtf?) when I updated it in RC. It was returning the check as 0.
Once they restarted Graal, it worked fine.

Hm I had something like that happen to me before aswell, except it was a serverside script not updating, and I had to restart the NPC Server to get it to update :x

The script was updated on RC, like you could read the changes, but none of the changes made a difference. It's like it was storing the script on the hard drive, but no reloading it into memory.