My server is hacked: 0x0007 0x0003 Disconnecting players

My server is hacked, I get the message at SR_ShardManager:
msg is not completely used : IP:xxx.xxx.xxx.xxx Req:0x0007 (0x0000) (MsgType:7), 32 - 31
msg is not completely used : IP:xxx.xxx.xxx.xxx Req:0x0003 (0x0000) (MsgType:7), 32 - 31

Disconnecting players when logging in, could it be a new IWA exploit. Please help me fix it

These messages are normal.

New IWA exploit? xd

Quote:

Originally Posted by #HB These messages are normal. New IWA exploit? xd

who ever called it iwa exploit: maybe one of these [Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by Devsome who ever called it iwa exploit: maybe one of these [Only registered and activated users can see links. Click Here To Register...]

Please help me fix it, I used a lot of code related 0x7007 but still got exploit

Quote:

Originally Posted by zalo0944172680 Please help me fix it, I used a lot of code related 0x7007 but still got exploit

Whatever filter you are using, just block it or use a whitelist.

Quote:

Originally Posted by Devsome Whatever filter you are using, just block it or use a whitelist.

#region 0x7007_CLIENT_CHARSCREEN
else if (_pck.Opcode == 0x7007)
{
if (!this.isCharScreen)
{
Send(false);
continue;
}
byte response = _pck.ReadUInt8();
switch (response)
{
#region Create char
case 1:
{
try
{
_pck.ReadAscii(); // Charname

_pck.ReadUInt32(); // RefObjID

_pck.ReadUInt8(); // Height

_pck.ReadUInt32(); // ItemID
_pck.ReadUInt32(); // ItemID
_pck.ReadUInt32(); // ItemID
_pck.ReadUInt32(); // ItemID
}
catch
{
this.DisconnectModuleSocket();
return;
}
}
break;
#endregion

#region Char screen call
case 2:
{
if (_pck.GetBytes().Length > 1)
{
MainForm.SUSPECT++;
this.DisconnectModuleSocket();
return;
}
}
break;
#endregion

#region Delete char by name
case 3:
{
int name_length = _pck.ReadAscii().Length;
if ((_pck.GetBytes().Length - name_length) != 3)
{
MainForm.SUSPECT++;
this.DisconnectModuleSocket();
return;
}
}
break;
#endregion

#region Restore char by name
case 4:
{
int name_length = _pck.ReadAscii().Length;
if ((_pck.GetBytes().Length - name_length) != 3)
{
MainForm.SUSPECT++;
this.DisconnectModuleSocket();
return;
}
}
break;
#endregion

#region Don't remember what this is, but it exists :)
case 5:
{
int name_length = _pck.ReadAscii().Length;
if ((_pck.GetBytes().Length - name_length) != 3)
{
MainForm.SUSPECT++;
this.DisconnectModuleSocket();
return;
}
}
break;
#endregion

#region Default
default:
{
this.DisconnectModuleSocket();
return;
}
#endregion

}

m_RemoteSecurity.Send(_pck);
Send(true);
continue;
}
#endregion


I used this code but still attacked the server, please help me fix it

Quote:

Originally Posted by Devsome who ever called it iwa exploit: maybe one of these [Only registered and activated users can see links. Click Here To Register...]

I know about that, but that was an old exploit and is fixed in most servers rn, but I'm laughing at the fact that he's calling any new exploit as IWA's, just because IWA released an exploit before.

Quote:

Originally Posted by zalo0944172680 #region 0x7007_CLIENT_CHARSCREEN else if (_pck.Opcode == 0x7007) { if (!this.isCharScreen) { Send(false); continue; } byte response = _pck.ReadUInt8(); switch (response) { #region Create char case 1: { try { _pck.ReadAscii(); // Charname _pck.ReadUInt32(); // RefObjID _pck.ReadUInt8(); // Height _pck.ReadUInt32(); // ItemID _pck.ReadUInt32(); // ItemID _pck.ReadUInt32(); // ItemID _pck.ReadUInt32(); // ItemID } catch { this.DisconnectModuleSocket(); return; } } break; #endregion #region Char screen call case 2: { if (_pck.GetBytes().Length > 1) { MainForm.SUSPECT++; this.DisconnectModuleSocket(); return; } } break; #endregion #region Delete char by name case 3: { int name_length = _pck.ReadAscii().Length; if ((_pck.GetBytes().Length - name_length) != 3) { MainForm.SUSPECT++; this.DisconnectModuleSocket(); return; } } break; #endregion #region Restore char by name case 4: { int name_length = _pck.ReadAscii().Length; if ((_pck.GetBytes().Length - name_length) != 3) { MainForm.SUSPECT++; this.DisconnectModuleSocket(); return; } } break; #endregion #region Don't remember what this is, but it exists :) case 5: { int name_length = _pck.ReadAscii().Length; if ((_pck.GetBytes().Length - name_length) != 3) { MainForm.SUSPECT++; this.DisconnectModuleSocket(); return; } } break; #endregion #region Default default: { this.DisconnectModuleSocket(); return; } #endregion } m_RemoteSecurity.Send(_pck); Send(true); continue; } #endregion I used this code but still attacked the server, please help me fix it

you have video demo exploit ?

close ur server and play gamegami

Quote:

Originally Posted by #HB I know about that, but that was an old exploit and is fixed in most servers rn, but I'm laughing at the fact that he's calling any new exploit as IWA's, just because IWA released an exploit before.

These exploits has nothing to do with me, people often miscredit me for years due to my nick..
IWA is name given to specific kind of sro exploits that disconnect players. Credits goes to goofie (he usually targeted servers which owned by arabs, hence the name IWA=I Warn Arabs)

Quote:

Originally Posted by Iwa13 (he usually targeted servers which owned by arabs, hence the name IWA=I Warn Arabs)

Wow, didn't know that, makes sense now.