toxy - Terraria Packet Editor / Proxy

What is toxy?
toxy is a third-party tool for the online game, Terraria.

toxy allows users to manipulate the data (packets) being sent between their game client and the game server they are connected to, without altering their client in any way. This allows for easy manipulation of the data (packets) without having to alter your client data files at all.

No modifications are needed to use toxy.


What can toxy do?
toxy comes stock with various features, but being open source allows the project to be extended and altered in many ways, easily.

toxy includes the following features:

• Manipulate, edit, alter, and drop packets to and from the game client and server.
• Ignore all damage packets being sent to and from the server.
• Ignore all buff/debuff packets being sent to and from the server.
• Max all damage being done by the local player sent to the server. (TShock proof.)
• Vac (Vacuum) players to the local player.
• Spawn any item with any prefix (when permitting) with any amount (when permitting.)
• Log all chat into a window separate from the game.
• Log packets into a file for analysis.
• Proxy the connection between the game and server. (Allows IP ban evasion.)
• Intercept outgoing chat messages starting with a period ('.') as a toxy command.
• toxy commands are handled in Lua allowing easy and quick creation of new commands on the fly.
• Lua interface to interact with commands; scripts are hot-loaded so no reloading of the application is needed while editing and creating new commands.

Is toxy detectable by TShock?
No. While toxy does include some hacking features, there is no way for TShock servers to determine if you are proxying the client and altering the game packets. toxy's damage hack also limits the maximum damage sent from the player to 175, which is the max damage allowed on stock TShock servers.

With that in place there is no means for TShock to detect that you are using toxy. Observant admins can still determine if you are cheating though, so be mindful to what you do.


What is the point of toxy? Isn't this just another hack/cheat?
Technically yes, toxy is a hacking/cheat tool.

However the purpose and intent of this tool is to raise awareness in the security flaws of Terraria's protocol as well as the poor implementation of security in terms of banning players.

My intentions with this tool is to gain awareness and hopefully get Redigit to recreate the Terraria protocol to NOT allow the client to alter data in the manner it is currently able to do. Terraria is currently WAY too open in terms of allowing the client(s) to send too much data to the server to manipulate things they should not be allowed.

Terraria's server should be handling things such as:

• Damage amounts to objects and players.
• Projectile creation, updates, movements, damage, etc.
• Player inventory syncing. (Allowing server to alter a players inventory.)
• Player movement, location, etc. (Players can currently freely teleport where ever they want.)
• Item spawning / creation.
• Distance calculations for damage, projectile interaction, block destruction, etc.
• However, the game DOES NOT currently do any of this. Instead, the stock game server is basically grounds for hacking, griefing and utter chaos leaving third-party creations like TShock to fix what should be stock in the game.

I am NOT encouraging anyone to use this tool to grief servers, cause issues with the game, or any malicious activity, however I am not your parent so I cannot stop you.

I wish that everyone would share this project on the Terraria forums to build awareness to get Redigit to actually fix the game where it needs the most fixing. The server.


Legal
Terraria (c) to Redigit / Terraria

I claim no ownership to the trademark Terraria or any of its content, data, images, etc.

I am not responsible for what happens while using this tool, or any code included in this project. You agree that by using this tool, its code, or anything associated with this project, that you are entirely that you take full responsibility for anything you do with it.

USE AT YOUR OWN RISK! THIS TOOL CAN GET YOU BANNED! YOU HAVE BEEN WARNED!


Project Links / Download

Screenshot
http://imageshack.us/a/img20/5277/cliento.png

---------- Post added at 12:00 PM ---------- Previous post was at 11:59 AM ----------

Changelog
v1.0.0.0

• Initial release.

Helpful Links

• toxy Usage: https://code.google.com/p/toxy/wiki/Usage
• toxy Proxy Usage: https://code.google.com/p/toxy/wiki/ProxyUsage

Exposed Lua API

• print( string ) - Prints a string to the toxy chat log.
• cprint( string, r, g, b ) - Prints a colored string to the toxy chat log.
• SendToClient( packet ) - Sends the given data to the client.
• SendToServer( packet ) - Sends the given data to the server.
• GetPlayerByName( string ) - Gets a player object by their name.
• GetPlayerById( string ) - Gets a player object by their id.

LuaInterface (Luanet) Information
toxy makes use of Luainterface, a binding between Lua and .NET which allows the application the ability to expose inner [managed] classes and objects to Lua. Toxy can be fully loaded into Lua and exposed using the following code at the top of your script(s):
You can then access toxy's classes easily, such as for creating packet objects and sending them to the client and server.
There are other useful things you can do, such as getting the local player id or local player object:
Information about the current world can be obtained too using:
You can browse the source code of toxy to see what other objects you can use and access.

I thought outside links weren't allowed, and has to be approved by minion

Does not work, after connecting to toxy it spits out this error:
edit: Well, atleast for me... It might work for you, I don't know.

It "kinda" works for me. I got kicked for exceeding max damage once, and I think vacuuming the players are visual; Unless you attack them while they are vacuumed >
*Ignore all damage doesn't work, i still die*

It's easier to make a hacked client than use this, lol

Use both

All links are to the project page which is entirely open source.
Feel free to compile everything yourself, or decompile the project with ILSpy or Reflector, nothing is altered / infected.

I have no interest in posting copies of compiled binaries on various sites to meet over-restrictive guidelines/rules that have no purpose on an open source project.


What operating system do you use? It sounds like your system is blocking the listening server inside of toxy from allowing you to connect to it.


Being kicked for exceeding max damage is the server, not toxy's fault. Vacuuming players works partially on TShock servers as well.
It's not just visual but after a certain distance TShock has protection for it.

On a stock server without TShock it will work anywhere though.

To each their own. If you don't want to use it, then don't. This is to avoid altering the client at all. I have my own custom client that I use as well (as seen in the video I posted for this), but I also enjoy seeing what other methods I can create to achieve things. The purpose of this project entirely is not to hack etc. but instead to raise awareness for the game to try to help fix its poor protocol design.

I use Windows 8, I guess that's the problem...

Thanks when I get a chance after moving I'll take a look into fixing it for Windows 8. Currently, it is setup to default listening on:
Perhaps running as an Administrator will fix your problem as well. But the loopback should work properly unless Windows 8 does something to stop it.

I just killed 5 people in a row before i got kicked. xD
Vac with max damage worked on one of the servers I got into.

Glad to hear you are enjoying it. Anyone else having issues I did make two small guides on setting things up here:
toxy Usage: https://code.google.com/p/toxy/wiki/Usage
toxy Proxy Usage: https://code.google.com/p/toxy/wiki/ProxyUsage

Nope, running as admin didn't work.
Why does everything good break on Win 8?

Mostly because it's garbage lol. I'll see if I can get Win8 running in a VM soon and see whats causing the issue to happen. I'm in the process of moving at the moment so I don't have my main dev machine unpacked atm to work on this.

What do you mean?