Cheat Windows

[Stowen]

Is there a way I can detect if a player has a hacking tool open? I know there is this for server options, but im not quite sure it works:

NPC Code:

---

cheatwindows=GraalRelay,Relay6,Relay,CheatEngine,A  rtMoney,DeadGraal

---

I guess what I am trying to ask, is there a scripting command I can use to detect specific programs being open? I'm trying to script a detection system for a server. We all know Relay injects packets/weapons to the client. Also, is there a command that would be helpful to find out if a weapon has been injected?

[cbk1994]

No, you can't see what programs a person has open. In theory you can use cheatwindows (may or may not still work, I know Stefan added a global list a while back) but in reality it's a waste of time because recent tools will easily evade this.

Look at a player's list of weapons (clientside). Are there weapons you don't recognize and that aren't from Login? There are plenty of other ways to inject code, though, so don't waste your time here either.

[scriptless]

Originally Posted by cbk1994

No, you can't see what programs a person has open. In theory you can use cheatwindows (may or may not still work, I know Stefan added a global list a while back) but in reality it's a waste of time because recent tools will easily evade this.

Look at a player's list of weapons (clientside). Are there weapons you don't recognize and that aren't from Login? There are plenty of other ways to inject code, though, so don't waste your time here either.

You can add weapons that aren't on the server?? I did not know this. I know many ways to "cheat" graal. What's funny is Cheat Engine has the capability of editing the window title of itself.. so it's pretty much not detectable if you don't want it to be.. while opening a folder named "Cheat Engine" or a webpage, that uses that title.. could screw you over royally.. We used to link people in PM's to websites with those titles just to DC them.. lmao.. gotta love Stefans support for abusive technology. Tho it's been many years... 2 or 3 since we did that.. I know just the other day I opened OllyDbg and graal closed on me.. o_o all I wanted to do was open the RC with it and dig around to figure out the error I was having with the font being displayed as rectangles instead of actual text.

Back on topic of preventing hacking.. you can impliment many checks.. like if a players distance has moved to much in too short of a time they are more then likely speed hacking.. you could log it and keep an eye on them.. also, you could or should log triggeractions that could be abused since people cannot inject serverside code but clientside code and trigger those actions still.. it really depends on your server, how things work, and what your trying to do as to how to help cut down on hacking.

[Crono]

Originally Posted by scriptless

You can add weapons that aren't on the server??

Yeah, downsider uses Era weapons on Zodiac. @_@

[scriptless]

Originally Posted by Crono

Yeah, downsider uses Era weapons on Zodiac. @_@

How? o.O I can't think of any way possible to have weapons from other servers.. or at least serverside weapons.. And im not sure of any way to have weapon names themself from other servers.. I only know hot to inject clientside code and that doesn't require adding new weapons.. the old old way from back in the day was to use artmoney and search for text like for classic bomb and bow.. and just alter it in memory..there are new ways now.. but im surprised.

[BlueMelon]

Best protection would be use use serverside validation, I know on era some old scripts (even some new scripts *cough*) have been exploited by sending a negative number to server side and then this happens.
player.rupees -= -(xrupees); which results in a positive number.
This can easily be avoided using simple checks, or even abs(num).
But what can you expect, people make mistakes.

[scriptless]

Originally Posted by BlueMelon

Best protection would be use use serverside validation, I know on era some old scripts (even some new scripts *cough*) have been exploited by sending a negative number to server side and then this happens.
player.rupees -= -(xrupees); which results in a positive number.
This can easily be avoided using simple checks, or even abs(num).
But what can you expect, people make mistakes.

We did that with the money transfer item on N-Pulse when Moonie was manager.. if I remember correctly I gave moonie like negative 3 million rupees.. LOL don't know if she ever found out tho. <3 moonie (dont be mad)

[Stowen]

I remember that money transfer script, alot of people used to abuse that before they fixed it lmao. But thanks guys, I'm definitely going to try out the clientside weapons check. I already have a movement speed logger, thanks for the idea though.

[Tim_Rocks]

I hacked Chris' virginity once.

[Stowen]

Nevermind I don't have a movement speed logger lol I was thinking of Staff Boots log for some reason. How would I go about doing this? I figure it would require some math and some temp.x and .y variables and such. Any ideas on how I should go about this?

[BlueMelon]

Some methods include tiles/second

[scriptless]

You can use a timeout, every second or so.. save temp positions for x and y.. but before saving those variables.. check current and calculate distance..

[Stowen]

Originally Posted by scriptless

You can use a timeout, every second or so.. save temp positions for x and y.. but before saving those variables.. check current and calculate distance..

So that would include determining players direction, correct? I tried the calculating distance, but I cant really figure out an efficient formula without figuring the players direction. Could somebody help me on a formula?

Originally Posted by BlueMelon

Some methods include tiles/second

How would I figure the tiles/second?

[scriptless]

direction doesnt matter.

as i said.. compare last x/y to current x/y every second..

PHP Code:

temp.distancex = abs(temp.ox - player.x);
temp.ox = player.x 


for example..

I use ABS for because we want the absolute value (non negative number)... if u move to the right.. it will be a negative number.. move to the left it will be positive.. making it abs will make it always positive.

[Stowen]

Ah alright. Ill give this a go, and let you know how it works. Thanks man!

[cbk1994]

Originally Posted by Stowen

So that would include determining players direction, correct? I tried the calculating distance, but I cant really figure out an efficient formula without figuring the players direction. Could somebody help me on a formula?

Originally Posted by cbk1994

Use the distance formula:



Therefore, to get distance

PHP Code:

function dist(x1, y1, x2, y2) {
  return (((x1 - x2) ^ 2) + ((y1 - y2) ^ 2)) ^ 0.5;
} 


..

[Stowen]

Originally Posted by cbk1994

..

Thanks, Chris, this actually helped me out a lot. I was just struggling, and came on to see if there were anymore replies.

[Stowen]

Alright guys, so I used the formula for distance that Chris has supplied me with and it works great. I get a constant moving speed of 10. Not sure what the measurement for speed on Graal would be LOL but I got 10. That's enough for me to do my work. Anyways, here's the script if anybody wishes to use it themselves.

PHP Code:

//#CLIENTSIDE

function onCreated() {
onTimeOut();
}

function onTimeOut() {
this.x1 = player.x;
this.y1 = player.y;
sleep(1);
this.x2 = player.x;
this.y2 = player.y;
dist(this.x1, this.y1, this.x2, this.y2);
}

function dist(x1, y1, x2, y2) { 
  this.dist = (((x1 - x2) ^ 2) + ((y1 - y2) ^ 2)) ^ 0.5;
  player.chat = this.dist;
  setTimer(0.05);
} 


[scriptless]

Originally Posted by cbk1994

..

I was trying to not confuse him since he's new to scripting. But that works better then what I suggested.

Originally Posted by Stowen

Alright guys, so I used the formula for distance that Chris has supplied me with and it works great. I get a constant moving speed of 10. Not sure what the measurement for speed on Graal would be LOL but I got 10. That's enough for me to do my work. Anyways, here's the script if anybody wishes to use it themselves.

PHP Code:

//#CLIENTSIDE

function onCreated() {
onTimeOut();
}

function onTimeOut() {
this.x1 = player.x;
this.y1 = player.y;
sleep(1);
this.x2 = player.x;
this.y2 = player.y;
dist(this.x1, this.y1, this.x2, this.y2);
}

function dist(x1, y1, x2, y2) { 
  this.dist = (((x1 - x2) ^ 2) + ((y1 - y2) ^ 2)) ^ 0.5;
  player.chat = this.dist;
  setTimer(0.05);
} 


Normally you set the timer at the end of the timeout function itself..

and sleep(1).. isn't needed.. let me adjust it a little.

PHP Code:

//#CLIENTSIDE
function onCreated() {
  this.x1 = player.x;
  this.y1 = player.y;
  setTimer(1);
}

function onTimeOut() {
  dist(this.x1, this.y1, player.x, player.y);
  // set the values to current position
  this.x1 = player.x;
  this.y1 = player.y;
  setTimer(1);
}

function dist(x1, y1, x2, y2) { 
  this.dist = (((x1 - x2) ^ 2) + ((y1 - y2) ^ 2)) ^ 0.5;
  player.chat = this.dist;
} 


The reason I changed it like this is becasue if you set the variables after you check the distance.. the next time the script runs the dist() function it will be using the old values.. then updating them after the comparison. also sleep causes script problems.. you can just set the timer to 1 second intervals and not need sleep() or waitfor()

[Stowen]

Ah thank you, and I'm not really new to scripting. I used to be very fluent in GS1 I just have some troubles with GS2, and I havent really done major scripting in a while, so I'm kinda rusty. Thanks for the tips, though, much appreciated. My big issue is complexity. I turn the simplest scripts into complex nightmares xD


*EDIT: Somebody has brought to my attention, and I can't believe I overlooked it myself. Warping from levels triggers it as speed hacking. How would I go about fixing that? I tried to do a level check, but it only sets the original variable on created, so that was pointless and rendered it useless. Any ideas?

[cbk1994]

Originally Posted by Stowen

*EDIT: Somebody has brought to my attention, and I can't believe I overlooked it myself. Warping from levels triggers it as speed hacking. How would I go about fixing that? I tried to do a level check, but it only sets the original variable on created, so that was pointless and rendered it useless. Any ideas?

In my experience you have to be very careful with these kinds of detection systems, they get a lot of false positives. When the player enters a new level, just reset the timer (wait, say, a second before you start keeping track of their speed).

[Stowen]

Yeah, I can imagine there to be alot of false positives. Without the level checks, I get one everytime somebody goes from one level to another. So just add an onPlayerEnters() command with the original x/y ?

Like this? :

PHP Code:

function onPlayerEnters() {
   this.x1 = player.x;
   this.y1 = player.y;
   setTimer(1);
} 


[cbk1994]

Originally Posted by Stowen

Yeah, I can imagine there to be alot of false positives. Without the level checks, I get one everytime somebody goes from one level to another. So just add an onPlayerEnters() command with the original x/y ?

Like this? :

PHP Code:

function onPlayerEnters() {
   this.x1 = player.x;
   this.y1 = player.y;
   setTimer(1);
} 


That is one way to do it, but ultimately your system needs to be more robust because you will have false positives in all kinds of cases. For starters, it shouldn't trigger an alarm until it's fairly certain a person is speed-hacking (sustained periods of time of increased speed).

[Stowen]

Originally Posted by cbk1994

For starters, it shouldn't trigger an alarm until it's fairly certain a person is speed-hacking (sustained periods of time of increased speed).

Yeah I was actually thinking about doing that. Right now I have a flag that staff have, and I'm using that to determine whether or not to monitor them. That's so it doesn't set off false positives for using boots. I'm going to attempt to script what you just suggested.

[scriptless]

Originally Posted by Stowen

Yeah I was actually thinking about doing that. Right now I have a flag that staff have, and I'm using that to determine whether or not to monitor them. That's so it doesn't set off false positives for using boots. I'm going to attempt to script what you just suggested.

You don't need a flag. Last I checked it was possible to check the staff= list in the server options.

And I would suggest playing with the script doing countless test's until you have it perfected how you want.

Also not much changed form GS1 to GS2.. with the exception that GS2 is now more object oriented and you use ( and ).. ex : player.chat instead of setplayerprop #c... and settimer() instead of timeout =...

you could add backup checks.. and do like this.lastlevel = ... to store current level and have the alarm part of it not go off if the level is now different. it would help ensure that onPlayerEnters() is setting the new variables before it does it's next check cycle.

Does anyone know if there is a onPlayerLeaves() command? I have never looked it up to see.

[Stowen]

Originally Posted by scriptless

Does anyone know if there is a onPlayerLeaves() command? I have never looked it up to see.

No I don't believe there is, but there is a onPlayerLogOut(). I've been working on it, and I found using onPlayerEnters() and setting the x/y again has fixed the level warping issue, so there arent anymore false positives from that. Now I'm working on recording how long they are moving at abnormal speeds, so lag doesn't set off more false positives. Thanks for all the help guys!

[Crow]

onPlayerLeaves() exists. Serverside event, and I believe the first parameter is the object of the player who left.

[ffcmike]

Originally Posted by Crow

onPlayerLeaves() exists. Serverside event, and I believe the first parameter is the object of the player who left.

onPlayerLeaves() uses the 'player' scope.
onPlayerLogout() has the player object as a parameter.

[Crow]

Originally Posted by ffcmike

onPlayerLeaves() uses the 'player' scope.
onPlayerLogout() has the player object as a parameter.

Good to know.

[scriptless]

Originally Posted by ffcmike

onPlayerLeaves() uses the 'player' scope.
onPlayerLogout() has the player object as a parameter.

Thanks, I thought there was both.. i remember gk getting the trade tables fixed because of player logout.. xD

would rep u but i give u to much rep as it is and it wont let me lol

[Stowen]

How would I go about getting a list of all the players weapons?

[MysticalDragon]

Originally Posted by Stowen

How would I go about getting a list of all the players weapons?

PHP Code:

    for ( i: player.weapons ) {
        if ( !i.name.starts( "-" ) ) {
          temp.itemList.add( i.name );
        }
      } 


Remove the "-" part if you want system NPCs to be included

[cbk1994]

Originally Posted by MysticalDragon

PHP Code:

    for ( i: player.weapons ) {
        if ( !i.name.starts( "-" ) ) {
          temp.itemList.add( i.name );
        }
      } 


Remove the "-" part if you want system NPCs to be included

Ideally use temp.i instead of just i. I think variables used in for statements are always temporary, but it improves readability imo.

[Tricxta]

Originally Posted by cbk1994

Ideally use temp.i instead of just i. I think variables used in for statements are always temporary, but it improves readability imo.

For stowen's benefit, might be worth mentioning that since the temp array is instantiated inside the for loop it'll be disposed of after the for loop ends so referencing it'll just refer to a null object, correct, no?

[cbk1994]

Originally Posted by Tricxta

For stowen's benefit, might be worth mentioning that since the temp array is instantiated inside the for loop it'll be disposed of after the for loop ends so referencing it'll just refer to a null object, correct, no?

It's not disposed of after the loop ends. It will be disposed of at the end of the function, though.

[scriptless]

Originally Posted by cbk1994

It's not disposed of after the loop ends. It will be disposed of at the end of the function, though.

Yeah, when I read that I was confused because I was under the impression it only terminated after the function. Other functions cannot read the variable tho right? like mid function you cannot call another function and try to read the variable?

I know temp. variables can be quite tricky to work with.

[cbk1994]

Originally Posted by scriptless

Yeah, when I read that I was confused because I was under the impression it only terminated after the function. Other functions cannot read the variable tho right? like mid function you cannot call another function and try to read the variable?

I know temp. variables can be quite tricky to work with.

Temporary variables aren't tricky to work with. In my experience, well over half of the variables you work with are temporary. They're only in scope in the current function, which is what makes them so useful.

[Stowen]

Thanks guys, I had something very similar it just had an error on my part so it wasn't working.

[Stowen]

In any case, now that I get a list of weapons, how would I go about detecting if a weapon gets added? Should I make a variable after onCreated that holds the info, and a timeout that keeps checking? I can script something that checks the weapons folder, and makes a list of all the weapons there. Then check the new weapons if its in the list, just disregard.

[Stowen]

Okay, I was testing some stuff out. I changed the temps to this. and made a new function to create a seperate list. I tried this and it kept returning false:

PHP Code:

function CheckInventory() {
  if (this.itemList == this.itemList2) {
    player.chat = "Check: Yes";
  }else player.chat = "Check: No";
} 


I also had them sent to me in a PM, both lists were the same. Why would it return they are not?