toxy - Terraria Packet Editor / Proxy

What is toxy?
toxy is a third-party tool for the online game, Terraria.

toxy allows users to manipulate the data (packets) being sent between their game client and the game server they are connected to, without altering their client in any way. This allows for easy manipulation of the data (packets) without having to alter your client data files at all.

No modifications are needed to use toxy.


What can toxy do?
toxy comes stock with various features, but being open source allows the project to be extended and altered in many ways, easily.

toxy includes the following features:

• Manipulate, edit, alter, and drop packets to and from the game client and server.
• Ignore all damage packets being sent to and from the server.
• Ignore all buff/debuff packets being sent to and from the server.
• Max all damage being done by the local player sent to the server. (TShock proof.)
• Vac (Vacuum) players to the local player.
• Spawn any item with any prefix (when permitting) with any amount (when permitting.)
• Log all chat into a window separate from the game.
• Log packets into a file for analysis.
• Proxy the connection between the game and server. (Allows IP ban evasion.)
• Intercept outgoing chat messages starting with a period ('.') as a toxy command.
• toxy commands are handled in Lua allowing easy and quick creation of new commands on the fly.
• Lua interface to interact with commands; scripts are hot-loaded so no reloading of the application is needed while editing and creating new commands.

Is toxy detectable by TShock?
No. While toxy does include some hacking features, there is no way for TShock servers to determine if you are proxying the client and altering the game packets. toxy's damage hack also limits the maximum damage sent from the player to 175, which is the max damage allowed on stock TShock servers.

With that in place there is no means for TShock to detect that you are using toxy. Observant admins can still determine if you are cheating though, so be mindful to what you do.


What is the point of toxy? Isn't this just another hack/cheat?
Technically yes, toxy is a hacking/cheat tool.

However the purpose and intent of this tool is to raise awareness in the security flaws of Terraria's protocol as well as the poor implementation of security in terms of banning players.

My intentions with this tool is to gain awareness and hopefully get Redigit to recreate the Terraria protocol to NOT allow the client to alter data in the manner it is currently able to do. Terraria is currently WAY too open in terms of allowing the client(s) to send too much data to the server to manipulate things they should not be allowed.

Terraria's server should be handling things such as:

• Damage amounts to objects and players.
• Projectile creation, updates, movements, damage, etc.
• Player inventory syncing. (Allowing server to alter a players inventory.)
• Player movement, location, etc. (Players can currently freely teleport where ever they want.)
• Item spawning / creation.
• Distance calculations for damage, projectile interaction, block destruction, etc.
• However, the game DOES NOT currently do any of this. Instead, the stock game server is basically grounds for hacking, griefing and utter chaos leaving third-party creations like TShock to fix what should be stock in the game.

I am NOT encouraging anyone to use this tool to grief servers, cause issues with the game, or any malicious activity, however I am not your parent so I cannot stop you.

I wish that everyone would share this project on the Terraria forums to build awareness to get Redigit to actually fix the game where it needs the most fixing. The server.


Legal
Terraria (c) to Redigit / Terraria

I claim no ownership to the trademark Terraria or any of its content, data, images, etc.

I am not responsible for what happens while using this tool, or any code included in this project. You agree that by using this tool, its code, or anything associated with this project, that you are entirely that you take full responsibility for anything you do with it.

USE AT YOUR OWN RISK! THIS TOOL CAN GET YOU BANNED! YOU HAVE BEEN WARNED!


Project Links / Download

Screenshot
http://imageshack.us/a/img20/5277/cliento.png

---------- Post added at 12:00 PM ---------- Previous post was at 11:59 AM ----------

Changelog
v1.0.0.0

• Initial release.

Helpful Links

• toxy Usage: https://code.google.com/p/toxy/wiki/Usage
• toxy Proxy Usage: https://code.google.com/p/toxy/wiki/ProxyUsage

Exposed Lua API

• print( string ) - Prints a string to the toxy chat log.
• cprint( string, r, g, b ) - Prints a colored string to the toxy chat log.
• SendToClient( packet ) - Sends the given data to the client.
• SendToServer( packet ) - Sends the given data to the server.
• GetPlayerByName( string ) - Gets a player object by their name.
• GetPlayerById( string ) - Gets a player object by their id.

LuaInterface (Luanet) Information
toxy makes use of Luainterface, a binding between Lua and .NET which allows the application the ability to expose inner [managed] classes and objects to Lua. Toxy can be fully loaded into Lua and exposed using the following code at the top of your script(s):
You can then access toxy's classes easily, such as for creating packet objects and sending them to the client and server.
There are other useful things you can do, such as getting the local player id or local player object:
Information about the current world can be obtained too using:
You can browse the source code of toxy to see what other objects you can use and access.