The New Upgrade System Script

Page 1 of 2 1 2
12/08/2011 19:39 popmircea95#1
Hi. Here is the new upgrade system script:
I'm studing this new script and maybe i could find some new bugs :) Please search, and if u find something interesting pls pm me!!!

At this moment I found how to influence upgrade succes chance with 5% uridium :) :P The one who want to know pls join UG 2.0 (elitepvpers ug).
L.E:
NEW! There is no 100% chance for upgrade. There is a change of <100 that means it is 99%!!! I missed an upgrade at 100% as many users wich said this on other forums!!!
Just look in function PlusUpgrade there is if(val < 100) and it should be if(val <= 100)
More thinks incoming!
12/08/2011 19:48 Sir'Gee#2
Let me see this for 2h, I will find a way.
12/08/2011 20:05 popmircea95#3
My friend missed 12 upgrades at 100%(lasers, drones and shields).
12/08/2011 20:15 ALVARO01#4
What´s UG 2.0 (elitepvpers ug).???
12/08/2011 20:16 Serraniel#5
I tryed to upgrade 8 items. All 50% chance and only 1 got upgraded -.-'
12/08/2011 20:23 popmircea95#6
OMG! BP is fucking cheating!!!
Please delete this topic, I'll post everything in UG!!! The guys here only want too leech, look at views!
12/08/2011 20:24 ALVARO01#7
Can u tell me what´s UG?
12/08/2011 20:37 matador-darkorbit#8
Quote:
Originally Posted by ALVARO01 View Post
Can u tell me what´s UG?
this is spam!!
search and you will find-.- there are many topics explaining what is UG..
12/08/2011 20:51 popmircea95#9
It's added to sticky :) Omg
12/08/2011 21:35 moldoveanu#10
Quote:
Originally Posted by ALVARO01 View Post
Can u tell me what´s UG?
UG = UNDERGROUND Forum
Look [Only registered and activated users can see links. Click Here To Register...]
12/08/2011 22:01 Sir'Gee#11
#Close Request

Get the Information by yourself and don't make all public.
12/09/2011 04:10 Snorlax#12
Quote:
Originally Posted by popmircea95 View Post
OMG! BP is fucking cheating!!!
Please delete this topic, I'll post everything in UG!!! The guys here only want too leech, look at views!
just edit your startpost.
12/09/2011 07:25 crs67#13
Quote:
Originally Posted by popmircea95 View Post
OMG! BP is fucking cheating!!!
Please delete this topic, I'll post everything in UG!!! The guys here only want too leech, look at views!
Edit and delete.
12/09/2011 08:12 0x60#14
Nome. There is no way to "hack" it. This is javascript, it's client side, and it sends a request to the server. All information is processed at the server. The only logical and possible way is by use of an "injection" which I have tried a couple times to no avail.
Code:
function numbersonly(e) {
var key;
var keychar;
if(window.event) key = window.event.keyCode;
else if(e) key = e.which;
else return true;
keychar = String.fromCharCode(key);
if((key==null)||(key==0)||(key==8)||
(key==9)||(key==13)||(key==27)) return true;
else if((('0123456789').indexOf(keychar)>-1))
return true;
else return false;
}
ensures you may not type in anything other than numbers (I disabled that so I could use backslashes and other chars) on the other hand,
Code:
function percentonly(input) {
val = parseInt(input.value);
if(val<5) val=5;
if(val>100) val=100;
if(val%5!=0) {
val = Math.round(val/10)*10;
}
input.value = val+'%';
jQuery('#chanceInfo').text(val+'%');
grade = val/5;
level = jQuery('#itemLevel').val()-1;
currency = jQuery('#itemCurrency').val();
currencyValue = jQuery('#itemCurrencyValue').val();
updateUpgradeInfo(grade, level, currency, currencyValue);
}

function minusUpgrade() {
val = parseInt(jQuery('#itemUpgradePercent').val());
if(val > 5) {
jQuery('#itemUpgradePercent').val(val-5+'%');
if (parseInt(jQuery('#itemUpgradePercent').val()) < 100) {
jQuery("#itemUpgradeButton div").html(buttonTextStartAttempt);
} else {
jQuery("#itemUpgradeButton div").html(buttonTextStart);
}
jQuery('#chanceInfo').text(val-5+'%');
grade = (val-5)/5;
level = jQuery('#itemLevel').val();
currency = jQuery('#itemCurrency').val();
currencyValue = jQuery('#itemCurrencyValue').val();
updateUpgradeInfo(grade, level-1, currency, currencyValue);
}
}

function plusUpgrade() {
val = parseInt(jQuery('#itemUpgradePercent').val());
if(val < 100) {
jQuery('#itemUpgradePercent').val(val+5+'%');
if (parseInt(jQuery('#itemUpgradePercent').val()) < 100) {
jQuery("#itemUpgradeButton div").html(buttonTextStartAttempt);
} else {
jQuery("#itemUpgradeButton div").html(buttonTextStart);
}
jQuery('#chanceInfo').text(val+5+'%');
grade = (val+5)/5;
level = jQuery('#itemLevel').val();
currency = jQuery('#itemCurrency').val();
currencyValue = jQuery('#itemCurrencyValue').val();
updateUpgradeInfo(grade, level-1, currency, currencyValue);
} else {
jQuery("#itemUpgradeButton").val(buttonTextStart);
}
}

function updateUpgradeInfo(grade, level, currency, currencyValue, resource_bonus, resource_bonus_short, resource_bonus_percent) {
if(grade != 1) {
// basic-costs + upgrade-costs
if(currency == 'Credits') {
costs_level_upgrade = 125000+level*125000*0.2;
for(var i=2; i<=grade; i++) {
costs_level_upgrade += 100000+i*0.05*level*500000;
}
}
else {
costs_level_upgrade = 200+level*200*0.75;
for(var i=2; i<=grade; i++) {
costs_level_upgrade += 60+(i-2)*15+level*15; //Uridium
}
}
} else {
// basic-costs
if(currency == 'Credits') costs_level_upgrade = 125000+level*125000*0.2;
else costs_level_upgrade = 200+level*200*0.75; //Uridium
}
costs_level_upgrade = 0.95*costs_level_upgrade;
jQuery('#costsInfo').text(parseInt(costs_level_upg rade)+' '+currencyValue);
bonus = jQuery('#itemBonus').val();
if(bonus.indexOf('/') != -1) {
bonus = bonus.split('/');
bonus = resource_bonus_percent.replace("%VALUE%", Math.round(parseFloat(bonus[0]*(level+1))*10)/10)
+'/'+resource_bonus_percent.replace("%VALUE%", Math.round(parseFloat(bonus[1]*(level+1))*10)/10);
} else bonus = resource_bonus_percent.replace("%VALUE%", Math.round(parseFloat(jQuery('#itemBonus').val()*( level+1))*10)/10);
jQuery('#bonusInfoTxt').attr('title',resource_bonu s_short).html(resource_bonus);
jQuery('#bonusInfo').text(bonus);
}

function updateUpgradeStatus(itemId, interval) {
upgrInfoText = '%VALUE%%';
upgrReadyText = 'Gata - clichează aici';
progress = parseFloat(jQuery('#progressId'+itemId).val());
tick = parseFloat(jQuery('#tickId'+itemId).val());
progress = progress+tick;
if(progress >= 100) {
interval=clearInterval(interval);
progress = 100;
jQuery('#infoId'+itemId).text(upgrReadyText);
finishUpgradeView(itemId);
jQuery('#upgrListItemId'+itemId).css('cursor','poi nter').click(function() {
document.upgradeForm.itemID.value=itemId;
document.upgradeForm.itemLevel.value=jQuery('#item LevelId'+itemId).text();
document.upgradeForm.itemType.value=jQuery('#typeI d'+itemId).val();
document.upgradeForm.submit();
});
jQuery('#itemLevel_'+itemId).css('background-position','-120px 0');
} else {
jQuery('#progressId'+itemId).val(progress);
upgrInfoText = upgrInfoText.replace("%VALUE%", Math.round(progress));
jQuery('#progressBar'+itemId).css('width',Math.rou nd(progress)+'%');
jQuery('#infoId'+itemId).text(upgrInfoText);
}
}
If we manage to change the values and submit to the server say level 2 upgrade, 100% chance, 5 credits; we might make it through, but I believe the server checks things like that.

This is what a request looks like for trying to upgrade a flax to lvl 3 from lvl 2

Code:
Request URL:http://us1.darkorbit.bigpoint.com/indexInternal.es
Request Method:POST
reloadToken: <HIDDEN>
action:internalItemUpgradeSystem
subAction:completeUpgrade
itemID:<HIDDEN>
itemLevel:2
itemType:drone
selectedType:
It convinces me that it is server-side checked.
12/09/2011 11:42 logical691#15
Cause it is, they wouldnt make the code so easy to find and exploit it would be checked in the php.
Page 1 of 2 1 2