Explanation of the CP Exploit that once plagued the game.

[Mega Byte]

I found this analysis I did on that leaked code that was in the Troy FTP one time. (TS2 Server code rofl) whilst I was cleaning out my hard drives of old old old backup stuff.

Pro-tip click the spoiler it drops down .

 Spoiler

case 235 : //[°ø´öÄ¡]->[±â¿©µµ]
  CopyMemory( &tValue, &tData[0], 4 );
  if( tValue < 1 )
  {
   mUSER[tUserIndex].Quit(__FILE__, __FUNCTION__, __LINE__);
                  
   return;
  }
  if( mUSER[tUserIndex].mAvatarInfo.aTeacherPoint < ( tValue * 20000 ) )
  {
   mUSER[tUserIndex].Quit(__FILE__, __FUNCTION__, __LINE__);
                  
   return;
  }
  if (mUSER[tUserIndex].mAvatarInfo.aLevel1 < 50) {
   mUSER[tUserIndex].Quit ();
   return ;
  }
  mUSER[tUserIndex].mAvatarInfo.aKillOtherTribe += tValue;
  mAVATAR_OBJECT[tUserIndex].mDATA.aKillOtherTribe += tValue;
  mUSER[tUserIndex].mAvatarInfo.aTeacherPoint -= ( tValue * 20000 );
  mTRANSFER.B_PROCESS_DATA_RECV( 0, tSort, &tData[0] );
  mUSER[tUserIndex].Send( TRUE, (char *) &mTRANSFER.mOriginal[0], mTRANSFER.mOriginalSize );
  return;

server side code for the merit to CP conversion
they check if cp you want is <1 which is good as that would be bad
they then do tValue * 20000 which we can overflow to be a different value we want :P
so if you have enough for the amount of times you want CP for each block of 20000 merit
it checks if your char level < 50 if it is no go
otherwise it gives you the amount
and takes away from your merits, the amount*20000

Problem 1, The server shouldnt need Value from client at all.
Problem 2 it does a * which we can overflow or w/e
It gives is the value o.O we can set it to w/e we want so long as it overflows and wraps around to something valid

Enjoy.

No requests, I can't be bothered with TS2 just thought I would upload this for aspiring exploit finders or game developers to understand how these kind of exploits work.

Here is an example of the exploit and a simple solution.



Check the releases directory for binarys you can try, enter -500 .

[SeiD001996]

its cp hack ? how to update adresses ? where is button pressing and give cp, how to update adresses ?

[shad0wboss]

interesting...

*hands crossed*

[aStudent]

Originally Posted by SeiD001996

its cp hack ? how to update adresses ? where is button pressing and give cp, how to update adresses ?

come down its not a cheat

[LuDaKa01]

Its script for cp hack , but how to update adresses

[almar12]

Originally Posted by LuDaKa01

Its script for cp hack , but how to update adresses

Don't even bother, As far as I know this code won't work with hungames.

Seriously start learning some actual coding instead of trying to leech other peoples script.

Oh and by the way, we all know you're SeiD001996.

[shad0wboss]

Originally Posted by almar12

Don't even bother, As far as I know this code won't work with hungames.

Seriously start learning some actual coding instead of trying to leech other peoples script.

Oh and by the way, we all know you're SeiD001996.

Humgames? Does it mean it'll work with mayn? I thought CP hack was patched after the downfall of aeria?

[MyDooMJr]

If this works on MAYN they will close right after.

[LuDaKa01]

How to update the adresses ?

[shad0wboss]

Originally Posted by MyDooMJr

If this works on MAYN they will close right after.

If idiots start using 99999999 cp, then yes... Might help bring prices of GPL though. *trollface*

[Mega Byte]

Some derpas here .. its not a hack or code for a hack its an explanation of the CP exploit that happend back on aeria ts2. would work on others if it has not been patched. it is an easy patch as you can see in my codes .

Didn't I say no requests? I guess asking for help is okay though.

You want to find the GameSendFunction

You need to be able to breakpoint / debug.

Stand somewhere alone in game.
Breakpoint send (its a winsock api call)

Anywho,
Find the game send function, it will be what called send.
(Execute till return then look for top of function)

Find all calls to this or do a conditional hook you want to breakpoint it only when the exchange merit packet goes through which you have to be over level 50 i think. It does time to merit? then merit to cp? i forget though its been forever.

When you identify this function you want to breakpoint game send or the code that calls game send.

Find the buffer its probably EDX pointer.


After packet id (9th? byte) write -500 as a float or was it a signed integer i forget.

Profit.


But if you don't know how to use cheat engine or a debugger your wasting your time go do some tutorials

[almar12]

CP hack doesnt work for mayngames either.

[SeiD001996]

teach how to update the adresses

[almar12]

Originally Posted by SeiD001996

teach how to update the adresses

Did you even read what Megabyte just wrote!?



Here let me QUOTE him for you:

Originally Posted by Mega Byte

Some derpas here .. its not a hack or code for a hack its an explanation of the CP exploit that happend back on aeria ts2. would work on others if it has not been patched. it is an easy patch as you can see in my codes .

Anyways Mega Byte happy birthday.

[LuDaKa01]

How to find calls,no teachs,its normaly to have a answers...