xp und gold hack

5hoursez · 11/04/2007, 14:54

I fiddled around a bit with it, but the gold would only show from my/client side... my gold amount would bounce up 5-6 mill but server only recognized me as having the real amount =/

Entelion · 11/04/2007, 15:56

so what ur sayong is that it wont work

menasculio · 11/04/2007, 16:49

Of course it wont. They would be suicidal to code things client side. It's the same as the exp thing i talked about. Haven't yet checked here but in most MMORPGs every item has an ID. Game client only sends game ID to the server and additional byte to tell server that user wants to sell an item. Then server checks your inventory, finds item (server side), takes amount of gold the item is worth (internally, still server side), wipes the item out of inventory (server side, u can block wipe packet going to client, but server will have the item removed anyways), and server will change amount of gold you have according to the calculated value( u can modify the packet to have 50000000000000 gold, but server will remember the good value).

Entelion · 11/04/2007, 16:53

sad

5hoursez · 11/04/2007, 18:33

Quote:

Originally Posted by menasculio

Of course it wont. They would be suicidal to code things client side. It's the same as the exp thing i talked about. Haven't yet checked here but in most MMORPGs every item has an ID. Game client only sends game ID to the server and additional byte to tell server that user wants to sell an item. Then server checks your inventory, finds item (server side), takes amount of gold the item is worth (internally, still server side), wipes the item out of inventory (server side, u can block wipe packet going to client, but server will have the item removed anyways), and server will change amount of gold you have according to the calculated value( u can modify the packet to have 50000000000000 gold, but server will remember the good value).

Yeah, I picked up on what you said in an earlier post and threw a thanks at you ^^ Maybe if the item's id could be spoofed thus making the server think it was something more valuable - but again unlikely as I was trying too spoof small potions into falsely being xl pots.. (buy smalls, sell smalls as XL) but the id's are random... etc

at least the inventory slots stay the same, i forgot if they change after restarting the game...

At least I am learning, that makes me happy. And I will have a leg up on the next new game that comes out ^__^

Entelion · 11/04/2007, 20:04

Quote:

Originally Posted by 5hoursez

And I will have a leg up on the next new game that comes out

witch??? AL ep3?

5hoursez · 11/04/2007, 20:12

any ....

chipthemunk · 11/06/2007, 00:18

Quote:

Originally Posted by menasculio

Of course it wont. They would be suicidal to code things client side. It's the same as the exp thing i talked about. Haven't yet checked here but in most MMORPGs every item has an ID. Game client only sends game ID to the server and additional byte to tell server that user wants to sell an item. Then server checks your inventory, finds item (server side), takes amount of gold the item is worth (internally, still server side), wipes the item out of inventory (server side, u can block wipe packet going to client, but server will have the item removed anyways), and server will change amount of gold you have according to the calculated value( u can modify the packet to have 50000000000000 gold, but server will remember the good value).

Regarding what you said the server doesnt "trust" the information it recives from clients, meaning it will check if they are true.

makes me wonder tho, how it was possible to hack the cooldown timers

(don't know if it was possible, havent tried)
Maybe the code didn't check that change (in the packets/data that was sent)
But as far as i heard its been fixed.

So as far as i see it will never be possible to change obvious values like gold, xp, amount of item x in inventory, stats, HP, MP. The Server tells the Client what it should display.

Guess its the same with the drops you get from the mob. (Guess thats why you see your drops with a little delay when playing at high lag times).

So i guess the only thing we can realy do is make bots (reading packets and/or reading client memory).

Or if you are lucky and find an exploit.

5hoursez · 11/06/2007, 04:16

Well maybe i am closer to gold than i think then... because I watched my gold pop from 400k to 7.2 mill selling 1 item ^^ but it was client view only and i had it froze so the amount did not change.... anyway probably wont get any further with it but may try next weekend.

I have seen certain areas of code that do the auth. check return true/false etc.. maybe taking some more time with this could help too... all in due time ^__^

sadisori1 · 11/06/2007, 14:20

tnx for hack

menasculio · 11/06/2007, 17:31

Quote:

makes me wonder tho, how it was possible to hack the cooldown timers (don't know if it was possible, havent tried)
Maybe the code didn't check that change (in the packets/data that was sent)
But as far as i heard its been fixed.

As I said in previous post, finding a good or any hack is not about modifying clientside packets but thinking what data can be sent to server in order to boost gold or something. Such data, that might not be verified by server, such data like the cooldown timers. It was all about modifying packets sent to server. Got patched cuz it went on forums...

You can block, modify incoming packets, but all that stuff is clientside. Your client sees something, and the server sees something else. You sell item, its the server that manages taking it from client inventory, calculating gold and so on. And its the server that does all the work and at the end sends client a packet telling 'remove item ID 10; add 750 gold'. Sending this information to the client is the last step, so whether u make it 7mln on the client side it doesnt really matter. U can memory hack and freeze gold, but you wont be able to buy any item past the real gold u have, cuz server knows that and server does not ask client about gold, and it was the server that informed client of gold not the opposite.

Of course clientside hacks are possible, I was successfull doing some clientside hacks in other MMORPG, just forget that it will make you infinite gold etc. You can try to spoof autoloot maybe, but not gold. Actually im gonna try to research this. To simulate im in pty so the client would think autoloot is on, and automatically pick items. But first I'll check whether game client sends the same info to server when u press space to pick item manually or when its auto looted. If it does, I'll know autoloot is clientside and will be able to spoof it. Not that its an uber hack, just some theory to investigate..

Cheers

Entelion · 11/06/2007, 17:41

Quote:

Originally Posted by menasculio

You can try to spoof autoloot

what do u mean by this?

menasculio · 11/06/2007, 19:48

I wanted to give an idea of a clientside hack. *IF* looting items in party is done from client side (ie. the game client itself "presses the space bar" when in auto loot party ) then it would be possible, to fool the game client, u are in party with autoloot on, thus you wouldnt have to have a real party to have items automally picked up from the floor.

chipthemunk · 11/07/2007, 15:05

@menasculio:

Quote:

As I said in previous post, finding a good or any hack is not about modifying clientside packets but thinking what data can be sent to server in order to boost gold or something. Such data, that might not be verified by server, such data like the cooldown timers. It was all about modifying packets sent to server.

agreed!

Quote:

Got patched cuz it went on forums...

Well you mean because it got posted on the forums lots of ppl used it and it became obvious is what you mean right?

about spoofing the client into thinking its in a party. Great idea!! : )
On the subject: How does AL handel party? I thought i read somewehere that AL uses IRC/ or something simmilar to chat/party. Not shure tho. Am i mixing something up here?

5hoursez · 11/10/2007, 07:58

Quote:

Originally Posted by menasculio

I wanted to give an idea of a clientside hack. *IF* looting items in party is done from client side (ie. the game client itself "presses the space bar" when in auto loot party ) then it would be possible, to fool the game client, u are in party with autoloot on, thus you wouldnt have to have a real party to have items automally picked up from the floor.

thanks, Menasculio for the input and ideas.. Everything I have learned how to do I have spent the time reading & trial/error since joining this forum.. which says more for me and the time i have spent.. compare to those that have just as many posts and still no input.... but only questions lol... and no I am not pointing fingers :P ent... lol

Anyways my mobo is fried, and wont be back on the forums for a while till i get it replaced.. just gonna rebuild new system rather than fork out the money for old parts... ^__^ thanks again and cya around