[SQL] Avatar MagicOpt Exploit Fix

02/10/2016 22:13 AceSpace#1
Hey,

It has been a while since i released something, however. This query will fix the issue with avatars. Though it's easy to fix it on filters.

Alright, just use the query.

It's your choice to use it or not. (Take a backup first in case something went wrong)

Code:
USE SRO_VT_SHARD

CREATE TABLE #MagOpt (
	MagicOptValue BIGINT
)

SET NOCOUNT ON

/* ######## Inserting the Magic Opt Values ######## */
INSERT INTO #MagOpt VALUES (4294967542)
INSERT INTO #MagOpt VALUES (4294967660)
INSERT INTO #MagOpt VALUES (4294967661)
INSERT INTO #MagOpt VALUES (4294967662)
INSERT INTO #MagOpt VALUES (4294967543)
INSERT INTO #MagOpt VALUES (4294967663)
INSERT INTO #MagOpt VALUES (4294967664)
INSERT INTO #MagOpt VALUES (4294967665)
INSERT INTO #MagOpt VALUES (4294967669)
INSERT INTO #MagOpt VALUES (4294967670)
INSERT INTO #MagOpt VALUES (4294967671)
INSERT INTO #MagOpt VALUES (4294967672)
INSERT INTO #MagOpt VALUES (4294967550)
INSERT INTO #MagOpt VALUES (4294967666)
INSERT INTO #MagOpt VALUES (4294967667)
INSERT INTO #MagOpt VALUES (4294967668)
INSERT INTO #MagOpt VALUES (21474836728)
INSERT INTO #MagOpt VALUES (644245094650)
INSERT INTO #MagOpt VALUES (21474836732)
INSERT INTO #MagOpt VALUES (107374182655)
INSERT INTO #MagOpt VALUES (4294967542)
INSERT INTO #MagOpt VALUES (4294967543)
INSERT INTO #MagOpt VALUES (21474836729)
INSERT INTO #MagOpt VALUES (644245094651)
INSERT INTO #MagOpt VALUES (21474836733)
INSERT INTO #MagOpt VALUES (107374182656)
INSERT INTO #MagOpt VALUES (21474836728)
INSERT INTO #MagOpt VALUES (107374182655)

SET NOCOUNT OFF

DECLARE @i TINYINT = 1;

WHILE @i != 5
BEGIN
	DECLARE @Query VARCHAR(MAX) =  'UPDATE I 
									SET I.ItemID = 0
									FROM SRO_VT_SHARD.._Inventory I
									JOIN SRO_VT_SHARD.._Items IT
									ON I.ItemID = IT.ID64
									WHERE IT.RefItemID IN (SELECT ID FROM SRO_VT_SHARD.._RefObjCommon WHERE TypeID1 = 3 AND TypeID2 = 1 AND TypeID3 = 13 AND TypeID4 in (1,2,3) AND Country = 3)
									AND IT.MagParam' + cast(@i as varchar(5)) +  ' NOT IN (SELECT MagicOptValue FROM #MagOpt) AND IT.MagParam' + cast(@i as varchar(5)) + ' 
									IS NOT NULL AND IT.MagParam' + cast(@i as varchar(5)) + ' != 0'

	EXEC (@Query)

	PRINT 'User Inventory [' + cast(@i as varchar(5)) + '] Cleared!'

	SET @Query =   'UPDATE I 
					SET I.ItemID = 0
					FROM SRO_VT_SHARD.._InventoryForAvatar I
					JOIN SRO_VT_SHARD.._Items IT
					ON I.ItemID = IT.ID64
					WHERE IT.RefItemID IN (SELECT ID FROM SRO_VT_SHARD.._RefObjCommon WHERE TypeID1 = 3 AND TypeID2 = 1 AND TypeID3 = 13 AND TypeID4 in (1,2,3) AND Country = 3)
					AND IT.MagParam' + cast(@i as varchar(5)) + ' NOT IN (SELECT MagicOptValue FROM #MagOpt) AND IT.MagParam' + cast(@i as varchar(5)) + ' 
					IS NOT NULL AND IT.MagParam' + cast(@i as varchar(5)) + ' != 0'

	EXEC (@Query)

	PRINT 'Avatar Inventory [' + cast(@i as varchar(5)) + '] Cleared!'

	SET @Query =   'UPDATE I 
					SET I.ItemID = NULL
					FROM SRO_VT_SHARD.._Chest I
					JOIN SRO_VT_SHARD.._Items IT
					ON I.ItemID = IT.ID64
					WHERE IT.RefItemID IN (SELECT ID FROM SRO_VT_SHARD.._RefObjCommon WHERE TypeID1 = 3 AND TypeID2 = 1 AND TypeID3 = 13 AND TypeID4 in (1,2,3) AND Country = 3)
					AND IT.MagParam' + cast(@i as varchar(5)) + ' NOT IN (SELECT MagicOptValue FROM #MagOpt) AND IT.MagParam' + cast(@i as varchar(5)) + '
					 IS NOT NULL AND IT.MagParam' + cast(@i as varchar(5)) + ' != 0'

	EXEC (@Query)

	PRINT 'Storage [' + cast(@i as varchar(5)) + '] Cleared!'

	SET @i += 1;
END

DROP TABLE #MagOpt
And that's it.
Thank you.
02/10/2016 23:55 ​Goofie​#2
The problem with this as all SQL fixes is that the player needs to Teleport before the item is removed. Meaning if you are running a server with free avatars and so on, it can still be exploited and used to get lucky increased on alchemy.

Maybe this is working, however. It's not really perfect for all servers.

Not here to start a fight, but Filter is probably the best fix for this.
02/11/2016 00:37 Dev Xan#3
Quote:
Originally Posted by ​Goofie​ View Post
The problem with this as all SQL fixes is that the player needs to Teleport before the item is removed. Meaning if you are running a server with free avatars and so on, it can still be exploited and used to get lucky increased on alchemy.

Maybe this is working, however. It's not really perfect for all servers.

Not here to start a fight, but Filter is probably the best fix for this.
i think so ,too
02/11/2016 00:52 AceSpace#4
Quote:
Originally Posted by ​Goofie​ View Post
The problem with this as all SQL fixes is that the player needs to Teleport before the item is removed. Meaning if you are running a server with free avatars and so on, it can still be exploited and used to get lucky increased on alchemy.

Maybe this is working, however. It's not really perfect for all servers.

Not here to start a fight, but Filter is probably the best fix for this.
It's a alternative solution for those who do not have filters, or if their filter doesn't have it fixed yet. People have abused it already, it would be better to run such a thing first to clean the mess.
02/11/2016 01:17 xxnukertube#5
Thanks bro ;)
this will help

Quote:
Msg 208, Level 16, State 1, Procedure _MagicOptBugFix, Line 4
Invalid object name 'Wolf.._AllowedMagicOpts'.
bro about this error

i'm just changed wolf to "SRO_VT_SHARD"
and work
--

(0 row(s) affected)

(405456 row(s) affected)

(2774 row(s) affected)

(185 row(s) affected)
02/11/2016 01:34 xxnukertube#6
[Only registered and activated users can see links. Click Here To Register...]
and now all sets from the server deleted lol ^^
02/11/2016 01:40 AceSpace#7
Quote:
Originally Posted by xxnukertube View Post
[Only registered and activated users can see links. Click Here To Register...]
and now all sets from the server deleted lol ^^
Wut ;o
I just used it on my test server with many avatars and it worked just fine, it didn't delete avatars with original magic opt values. others were removed. Make sure u inserted the lines
02/11/2016 01:43 LetsSro#8
and ?!
02/11/2016 01:45 AceSpace#9
Quote:
Originally Posted by LetsSro View Post
and ?!
And?
02/11/2016 03:08 ​Goofie​#10
Quote:
Originally Posted by xxnukertube View Post
[Only registered and activated users can see links. Click Here To Register...]
and now all sets from the server deleted lol ^^
Quote:
Originally Posted by Skipper* View Post
Wut ;o
I just used it on my test server with many avatars and it worked just fine, it didn't delete avatars with original magic opt values. others were removed. Make sure u inserted the lines
It removes sets because sets also can have blues.

By the way,
Ace coding strikes again!
02/11/2016 03:19 xxnukertube#11
my luck I'd just back up. nearly bankrupted my server
02/11/2016 04:27 Laag#82#12
good job
02/11/2016 06:46 AceSpace#13
Quote:
Originally Posted by ​Goofie​ View Post
It removes sets because sets also can have blues.

By the way,
Ace coding strikes again!
Have u even tested it? :facepalm: If everyone believed an idiot, this would be the world's end.
Alright, updated it again. By the logic, it should have worked well. But something was wrong, I had to test again on my test server. It's working fine now.
02/11/2016 06:48 ​Goofie​#14
Quote:
Originally Posted by Skipper* View Post
Have u even tested it? :facepalm: If everyone believed an idiot, this would be the world's end.
I learned the hard way that sometimes "idiots" or whatever you refer them to is sometimes right. Even if I wanted to almighty and say "Oh its your problem, I always make sure that there is not something wrong in my program or query etc."

So you should listen to everyone before setting your mind.
02/11/2016 08:20 ​Goofie​#15
Quote:
Originally Posted by hazemooking View Post
and you should stop messing with people's servers
I did that a long time ago, as you see I'm not involved in the advertisement section any more.