Always New Ideas...

[haikiri]

I noticed the boutique lists of changes isn't regulated by server side or at least partially. Then I had this amazing idea...
just kidding... its just an idea and maybe you guys with more experience already know or can put to test.
You prolly noticed that in those small patches is when they change the boutique sales and I started to wonder if we could use an OOG to create a boutique that we want. Similar to old exploit of Dragon Points where all you had to do is change the item ID.
Unless the server has a copy of the current sales list to compare so nothing gets sold out of that list it should work.
And before hand, let me warn you that there is a very high possibility that wild swoosh will spawn yelling no, its impossibru >.<
Just like he said it was impossible to cast skills faster ignoring the visual lock of skills for cool down. He always try to discourage people from trying things that might put an end to his precious ring, I mean, pgrind.

[Sᴡoosh]

Originally Posted by haikiri

I noticed the boutique lists of changes isn't regulated by server side or at least partially. Then I had this amazing idea...
just kidding... its just an idea and maybe you guys with more experience already know or can put to test.
You prolly noticed that in those small patches is when they change the boutique sales and I started to wonder if we could use an OOG to create a boutique that we want. Similar to old exploit of Dragon Points where all you had to do is change the item ID.
Unless the server has a copy of the current sales list to compare so nothing gets sold out of that list it should work.
And before hand, let me warn you that there is a very high possibility that wild swoosh will spawn yelling no, its impossibru >.<
Just like he said it was impossible to cast skills faster ignoring the visual lock of skills for cool down. He always try to discourage people from trying things that might put an end to his precious ring, I mean, pgrind.

Sorry to disappoint, but yeah, server maintains a list of items and prices.
And I don't even care about pgrind anymore, notice how I haven't updated it for new expansion since a week. Will happen, but idk when.

[jasty]

The easiest way to confirm if something like this is possible is by examining the packet you send when you buy something. When I checked it it only has item ID and a position ID in the list, no pricing info. You can't cheat on the price if it doesn't ask your client what the price is in the first place.

I've also tried buying items that aren't listed but I never found anything it would accept.

[n05f3247u]

so what you are saying is that the "purchase" request is not sent to the server but to the cl ient?
so you could change the item-ID you are purchasing client side?

i am not understanding...
prices are set client-side?
so you can f.e. buy items worth 10 gold for 1 silver?

[No0oB]

no, what they are saying is that you can NOT do that because the prices are set on the server not the client, the client just also has a list of those items but modifying the client list to "cheat" does not work

[n05f3247u]

i will leave this here...
talking with a friend... PWI recently introduced a charge raffle wheel that delivers items (coded in javascript)


the wheel is in the middle of the page

this should be the line that sets the item delivered to selected char,


if the line is not validated server side, would it be possible to exploit it idk edit the item ID http request or smt

my friend also mentioned wireshark
any clues?

[haikiri]

I didn't mean to get things for free. Just get them whenever we want. Like lets say I "save" the settings of a purchase of *12 orb now because I dont have the gold during the sales period but will have it later. Then, when I get the gold cashed in I could just purchase it even tho its not in the boutique anymore.
And maybe worse. Depending on the code, use the price of something cheap like 23cents wrath rep with the ID of the Orb *12 instead of rep. Like old days in DQ.
But, possible or not, I don't think the guys who know how to verify that would share the result if positive because once its out they get it patched really fast.

[n05f3247u]

well i am too noob to work on that
but if i could, i would and make it public
PWE as a company does not deserve **** for the ****** up stuff they do