[SQL] Avatar MagicOpt Exploit Fix

[AceSpace]

Hey,

It has been a while since i released something, however. This query will fix the issue with avatars. Though it's easy to fix it on filters.

Alright, just use the query.

It's your choice to use it or not. (Take a backup first in case something went wrong)

USE SRO_VT_SHARD

CREATE TABLE #MagOpt (
	MagicOptValue BIGINT
)

SET NOCOUNT ON

/* ######## Inserting the Magic Opt Values ######## */
INSERT INTO #MagOpt VALUES (4294967542)
INSERT INTO #MagOpt VALUES (4294967660)
INSERT INTO #MagOpt VALUES (4294967661)
INSERT INTO #MagOpt VALUES (4294967662)
INSERT INTO #MagOpt VALUES (4294967543)
INSERT INTO #MagOpt VALUES (4294967663)
INSERT INTO #MagOpt VALUES (4294967664)
INSERT INTO #MagOpt VALUES (4294967665)
INSERT INTO #MagOpt VALUES (4294967669)
INSERT INTO #MagOpt VALUES (4294967670)
INSERT INTO #MagOpt VALUES (4294967671)
INSERT INTO #MagOpt VALUES (4294967672)
INSERT INTO #MagOpt VALUES (4294967550)
INSERT INTO #MagOpt VALUES (4294967666)
INSERT INTO #MagOpt VALUES (4294967667)
INSERT INTO #MagOpt VALUES (4294967668)
INSERT INTO #MagOpt VALUES (21474836728)
INSERT INTO #MagOpt VALUES (644245094650)
INSERT INTO #MagOpt VALUES (21474836732)
INSERT INTO #MagOpt VALUES (107374182655)
INSERT INTO #MagOpt VALUES (4294967542)
INSERT INTO #MagOpt VALUES (4294967543)
INSERT INTO #MagOpt VALUES (21474836729)
INSERT INTO #MagOpt VALUES (644245094651)
INSERT INTO #MagOpt VALUES (21474836733)
INSERT INTO #MagOpt VALUES (107374182656)
INSERT INTO #MagOpt VALUES (21474836728)
INSERT INTO #MagOpt VALUES (107374182655)

SET NOCOUNT OFF

DECLARE @i TINYINT = 1;

WHILE @i != 5
BEGIN
	DECLARE @Query VARCHAR(MAX) =  'UPDATE I 
									SET I.ItemID = 0
									FROM SRO_VT_SHARD.._Inventory I
									JOIN SRO_VT_SHARD.._Items IT
									ON I.ItemID = IT.ID64
									WHERE IT.RefItemID IN (SELECT ID FROM SRO_VT_SHARD.._RefObjCommon WHERE TypeID1 = 3 AND TypeID2 = 1 AND TypeID3 = 13 AND TypeID4 in (1,2,3) AND Country = 3)
									AND IT.MagParam' + cast(@i as varchar(5)) +  ' NOT IN (SELECT MagicOptValue FROM #MagOpt) AND IT.MagParam' + cast(@i as varchar(5)) + ' 
									IS NOT NULL AND IT.MagParam' + cast(@i as varchar(5)) + ' != 0'

	EXEC (@Query)

	PRINT 'User Inventory [' + cast(@i as varchar(5)) + '] Cleared!'

	SET @Query =   'UPDATE I 
					SET I.ItemID = 0
					FROM SRO_VT_SHARD.._InventoryForAvatar I
					JOIN SRO_VT_SHARD.._Items IT
					ON I.ItemID = IT.ID64
					WHERE IT.RefItemID IN (SELECT ID FROM SRO_VT_SHARD.._RefObjCommon WHERE TypeID1 = 3 AND TypeID2 = 1 AND TypeID3 = 13 AND TypeID4 in (1,2,3) AND Country = 3)
					AND IT.MagParam' + cast(@i as varchar(5)) + ' NOT IN (SELECT MagicOptValue FROM #MagOpt) AND IT.MagParam' + cast(@i as varchar(5)) + ' 
					IS NOT NULL AND IT.MagParam' + cast(@i as varchar(5)) + ' != 0'

	EXEC (@Query)

	PRINT 'Avatar Inventory [' + cast(@i as varchar(5)) + '] Cleared!'

	SET @Query =   'UPDATE I 
					SET I.ItemID = NULL
					FROM SRO_VT_SHARD.._Chest I
					JOIN SRO_VT_SHARD.._Items IT
					ON I.ItemID = IT.ID64
					WHERE IT.RefItemID IN (SELECT ID FROM SRO_VT_SHARD.._RefObjCommon WHERE TypeID1 = 3 AND TypeID2 = 1 AND TypeID3 = 13 AND TypeID4 in (1,2,3) AND Country = 3)
					AND IT.MagParam' + cast(@i as varchar(5)) + ' NOT IN (SELECT MagicOptValue FROM #MagOpt) AND IT.MagParam' + cast(@i as varchar(5)) + '
					 IS NOT NULL AND IT.MagParam' + cast(@i as varchar(5)) + ' != 0'

	EXEC (@Query)

	PRINT 'Storage [' + cast(@i as varchar(5)) + '] Cleared!'

	SET @i += 1;
END

DROP TABLE #MagOpt

And that's it.
Thank you.

[​Goofie​]

The problem with this as all SQL fixes is that the player needs to Teleport before the item is removed. Meaning if you are running a server with free avatars and so on, it can still be exploited and used to get lucky increased on alchemy.

Maybe this is working, however. It's not really perfect for all servers.

Not here to start a fight, but Filter is probably the best fix for this.

[Dev Xan]

Originally Posted by ​Goofie​

The problem with this as all SQL fixes is that the player needs to Teleport before the item is removed. Meaning if you are running a server with free avatars and so on, it can still be exploited and used to get lucky increased on alchemy.

Maybe this is working, however. It's not really perfect for all servers.

Not here to start a fight, but Filter is probably the best fix for this.

i think so ,too

[AceSpace]

Originally Posted by ​Goofie​

The problem with this as all SQL fixes is that the player needs to Teleport before the item is removed. Meaning if you are running a server with free avatars and so on, it can still be exploited and used to get lucky increased on alchemy.

Maybe this is working, however. It's not really perfect for all servers.

Not here to start a fight, but Filter is probably the best fix for this.

It's a alternative solution for those who do not have filters, or if their filter doesn't have it fixed yet. People have abused it already, it would be better to run such a thing first to clean the mess.

[xxnukertube]

Thanks bro
this will help

Msg 208, Level 16, State 1, Procedure _MagicOptBugFix, Line 4
Invalid object name 'Wolf.._AllowedMagicOpts'.

bro about this error

i'm just changed wolf to "SRO_VT_SHARD"
and work
--

(0 row(s) affected)

(405456 row(s) affected)

(2774 row(s) affected)

(185 row(s) affected)

[xxnukertube]

and now all sets from the server deleted lol ^^

[AceSpace]

Originally Posted by xxnukertube

and now all sets from the server deleted lol ^^

Wut ;o
I just used it on my test server with many avatars and it worked just fine, it didn't delete avatars with original magic opt values. others were removed. Make sure u inserted the lines

[LetsSro]

and ?!

[AceSpace]

Originally Posted by LetsSro

and ?!

And?

[​Goofie​]

Originally Posted by xxnukertube

and now all sets from the server deleted lol ^^

Originally Posted by Skipper*

Wut ;o
I just used it on my test server with many avatars and it worked just fine, it didn't delete avatars with original magic opt values. others were removed. Make sure u inserted the lines

It removes sets because sets also can have blues.

By the way,
Ace coding strikes again!

[xxnukertube]

my luck I'd just back up. nearly bankrupted my server

[Laag#82]

good job

[AceSpace]

Originally Posted by ​Goofie​

It removes sets because sets also can have blues.

By the way,
Ace coding strikes again!

Have u even tested it? If everyone believed an idiot, this would be the world's end.
Alright, updated it again. By the logic, it should have worked well. But something was wrong, I had to test again on my test server. It's working fine now.

[​Goofie​]

Originally Posted by Skipper*

Have u even tested it? If everyone believed an idiot, this would be the world's end.

I learned the hard way that sometimes "idiots" or whatever you refer them to is sometimes right. Even if I wanted to almighty and say "Oh its your problem, I always make sure that there is not something wrong in my program or query etc."

So you should listen to everyone before setting your mind.

[​Goofie​]

Originally Posted by hazemooking

and you should stop messing with people's servers

I did that a long time ago, as you see I'm not involved in the advertisement section any more.