Quote:
Originally Posted by John Dread
Shiva wasn't the first to have clientless. Also he explained why it is taking so long while goldbots still have the feature. Hackshield just lets Joymax detect clientless players. You can theoretically use it but the risk of getting banned is really high. Goldbot companies don't care if their chars get banned after 2-4 weeks. They collect gold anyway.
|
It doesn't just detect CL. The thing that makes HS "strong" is two points:
1. It's packed with themida and its net code is VM'ed
2. It has its own special packet that's handled in the SRO netcode
I've said this many times that with HS you have to BUY that themida license. When themida wasn't used, HS was cracked rather quickly, in several hours of release. Now that it's there, removing it becomes the largest waste of time. So the only real protection provided here is themida. A better solution for JM would've been to just buy themida and protect their sro_client with it, possibly VM'ing their netcode loop.
So it detects clientless only insofar that they can't decode that netcode packet and properly respond to it (it may ask for one of several different types of scans, etc). But also, HS loads a driver, it's a rather intensive and intrusive application, and this behavior is not at all agreed to by the end-user, which means legally we have every right to remove it. However, removing HS (which is easy) will also cause your client to D/C. Whenever the server sends an HS packet, it stops sending the client packets until a response is received, this usually happens 15 minutes in, but if you reconnect over and over, it starts sending it to you right away.
I'd be up for looking into the legality of such a setup (rootkit basically, installed without permission, and cannot be removed to use software we are licensed to use that does not explicitly say that the rootkit must also be run). Perhaps the EFF would be willing to file a lawsuit to get things like HS/GG made illegal without the proper disclosure.
Also, there's a potential attack. The data queued up to be sent to you is sent after the HS response is received. This cannot be done in the system's I/O buffer, so it must be done in the actual server software itself by way of check (if (waiting_for_hs_response) queue(packet); else send(packet)
. The idea then would be to get 100+ clients in a CL fashion, spam the fuck out of packets that generate a response from the server once you get the HS packet, and try to fill up the memory and cause it to fault and crash.
I'd laugh so hard if that worked. More than likely it'll just disconnect you if it determines your buffer is too large. But if we all run it, thousands and thousands of connections, we might be able to do it. Yay for crashing official servers. We can say "GET RID OF HS OR SERVERS STAY DOWN!".
