[Security] Stop Speedhacking Once and For all

[Labmonkey]

Ok so I am just going to port over the code I used for firecaster (the closed beta version of which has lagless and completely secure movement). Hopefully you all can follow along with what I am doing.

All of this should be serverside (hopefully)

First add these values to tempplayerrec

Code:

MovesLeft As Byte
    MovesRight As Byte
    MovesUp As Byte
    MovesDown As Byte
    CanMoveWhen As Long

They will come into use later, but you might as well do them all at once.

At the bottom of modServerLoop add

Code:

Private Sub UpdatePlayerMovement()
Dim i As Integer
    For i = 1 To High_Index
        With TempPlayer(i)
            If .CanMoveWhen  0 Then
                .CanMoveWhen = .CanMoveWhen - 1
                If .CanMoveWhen = 0 Then
                    If .MovesDown > 0 Then
                        Call PlayerMove(i, DIR_DOWN, MOVING_RUNNING)
                        .MovesDown = .MovesDown - 1
                    ElseIf .MovesUp > 0 Then
                        Call PlayerMove(i, DIR_UP, MOVING_RUNNING)
                        .MovesUp = .MovesUp - 1
                    ElseIf .MovesLeft > 0 Then
                        Call PlayerMove(i, DIR_LEFT, MOVING_RUNNING)
                        .MovesLeft = .MovesLeft - 1
                    ElseIf .MovesRight > 0 Then
                        Call PlayerMove(i, DIR_RIGHT, MOVING_RUNNING)
                        .MovesRight = .MovesRight - 1
                    End If
                End If
            End If
        End With
    Next i
End Sub

In sub ServerLoop under

Code:

Dim LastUpdatePlayerVitals As Long

add

Code:

Dim LastUpdatePlayerMovement As Long

under

Code:

' Checks to save players every 10 minutes - Can be tweaked
        If Tick > LastUpdateSavePlayers Then
            UpdateSavePlayers
            LastUpdateSavePlayers = GetTickCount + 600000
        End If

Put

Code:

If Tick > LastUpdatePlayerMovement Then
            UpdatePlayerMovement
            LastUpdatePlayerMovement = GetTickCount + 30
        End If

The 30 value corresponds to the walktimer section of the client. If you don't know what that is, then do not change the 30.

Now in sub PlayerMove
under

Code:

' Check for subscript out of range
    If IsPlaying(Index) = False Or Dir < DIR_UP Or Dir > DIR_RIGHT Or Movement < 1 Or Movement > 2 Then
        Exit Sub
    End If

put

Code:

If TempPlayer(Index).CanMoveWhen > 0 Then
        If Dir = DIR_RIGHT Then TempPlayer(Index).MovesRight = TempPlayer(Index).MovesRight + 1
        If Dir = DIR_DOWN Then TempPlayer(Index).MovesDown = TempPlayer(Index).MovesDown + 1
        If Dir = DIR_LEFT Then TempPlayer(Index).MovesLeft = TempPlayer(Index).MovesLeft + 1
        If Dir = DIR_UP Then TempPlayer(Index).MovesUp = TempPlayer(Index).MovesUp + 1
        Exit Sub
    End If
    'lets set their movement timer
    TempPlayer(Index).CanMoveWhen = 4

The 4 is gotten by dividing the tile size, 32, by the runspeed (we use run speed to give players the benefit of the doubt) which by default is 8
32/8=4

This code is currently being tested, but if you can find bugs before I do that would be greatly appreciated.

Ok put this last fix and it should be good
find

Code:

Call HackingAttempt(Index, "Position Modification")

replace it with

Code:

Call SendPlayerXY(Index)

[Beres]

So this will pretty much stop users from using that "Cheat Engine"..

[Labmonkey]

Yes.


Ok, so before you test this and say it doesn't work, let me explain what the results should look like.

If a person is speedhacking, it will look like to them they are speedhacking! But if you log on twice to the server, the other person (not speedhacking) will see the person moving normally. If you walk in front of someone speedhacking, they will probably also get booted for position modification .

Currently there is a problem where some people also get booted while running. I am fixing it currently.



EDIT: Ok, for everyone that wants to use this here is a temporary (maybe permanent) fix.

Find

Code:

Call HackingAttempt(Index, "Position Modification")

and replace it with

Code:

Call PlayerWarp(Index, GetPlayerMap(Index), GetPlayerX(Index), GetPlayerY(Index))

[phelpsy]

this is brilliant i love it xD

[Robin]

Yes.


Ok, so before you test this and say it doesn't work, let me explain what the results should look like.

If a person is speedhacking, it will look like to them they are speedhacking! But if you log on twice to the server, the other person (not speedhacking) will see the person moving normally. If you walk in front of someone speedhacking, they will probably also get booted for position modification .

Currently there is a problem where some people also get booted while running. I am fixing it currently.



EDIT: Ok, for everyone that wants to use this here is a temporary (maybe permanent) fix.

Find

Code:

Call HackingAttempt(Index, "Position Modification")

and replace it with

Code:

Call PlayerWarp(Index, GetPlayerMap(Index), GetPlayerX(Index), GetPlayerY(Index))

PlayerWarp is a cheap fix. Set up a new function that sets the client's position without re-sending all the data to everyone. If that's your idea of a 'permanent fix' then you're very silly.

You should edit the server timer to take into account the obvious fluctations in connection speed and reliability.

Also, moved to the tutorial section.

[Labmonkey]

The playerwarp, if you notice, says temporary.

The server timer is fine being exact, as nothing bad happens if it catches you "speed hacking". Even if two packets come in close together, the server will still move you the same, and the client (if it isn't actually hacking) will also move you the same, and everything will be in sync.

Yes, I am going to change the update packet, but I left right after I made this tutorial, so if you needed to stop speedhacking you could use it as a semi-permanent fix and nothing terribly bad would happen.




Also, why was this moved? Isn't the section I put it in for bug-fixes? I would not really call this a feature.

[Robin]

The playerwarp, if you notice, says temporary.

(maybe permanent)

Also, why was this moved? Isn't the section I put it in for bug-fixes? I would not really call this a feature.

Because it's not fixing a bug. It's a feature which prevents speed hacking.

[Labmonkey]

so if you needed to stop speedhacking you could use it as a semi-permanent fix and nothing terribly bad would happen.

Stop selective reading.


My game has so many featuers! You can't speedhack, or crash the server, or steal my bank account number, or make my computer explode, or shut down google.com, or accidentally install chaos engine with it! Don't you want to play it .


Anyway, it doesn't really matter. I should have the new packet thing up in a few minutes.

[Robin]

My game has so many featuers! You can't speedhack, or crash the server, or steal my bank account number, or make my computer explode, or shut down google.com, or accidentally install chaos engine with it! Don't you want to play it .

You're mixing up the features of the game, and the features of the engine.

If your game didn't have packet sanitisation then a lot of people wouldn't play your game, as it'd be down half the time if OGCore's community is anything to go by.

You might not want to advertise the features which you added to the core engine, but without them your game would a be a lot worse.

[Labmonkey]

It depends on your definition of feature, if you want to continue the argument you can get on msn or something, but otherwise i think we should just let it die. :mrgreen:

Anyway, I put up the fix in the main post. Apparently ms4 has a sendplayerxy function. Cool.

[Robin]

It depends on your definition of feature

I tend to use the actual definition of words, rather than making up my own. ;D

But I'll drop the subject. Have fun working on the feature.

[Matt]

Stopping any form of hack isn't a feature, nor is it a bug fix. It'd vote it more of an optimization than anything.

*shrugs*

[Labmonkey]

We use to have a security section...

[Matt]

We use to have a security section...

Yeah. Security is def where this belongs.

[Rian]

I have to agree. After all, I suggested to Shan the security section way back. I think that's what led me to getting moderator status

[Jacob]

The problem with those sections, there weren't that many posts. I would just tag the thread title like "[Security] Title".

[Matt]

The problem with those sections, there weren't that many posts. I would just tag the thread title like "[Security] Title".

Not a bad idea.

[Rian]

True that.

[Joost]

Isn't my g15 keyboard a much greater threat than speedhacking? I was able to level a bit overnight using mah keyboard on James's game.

[Labmonkey]

Yes, botting is also a theat, but that has to do with the way your game is structured. It is very easy to bot a mindless game, one where monsters dont damage you, and levels are based on how much time you spend grinding. It is much harder to bot games where monsters actually hurt you, and grind is minimum. Games like that are also more fun .


But I don't see what any of this has to do with speedhacking. It was a major problem, and I fixed it. If you want to make a new topic on botting then go ahead.