[FSoD] Long Name Hack Fix

I'll keep this short... There is a hack that allows someone to register an account with an absurdly long name. If you see this name in-game, anywhere, it will freeze your client.

Go to HelloHandler.cs, and add this if statement underneath the guest account checker.

Image

Yes I fixed the typo in "many".

Code:

if (client.Account.Name.Length > 20) //Name Length Detection
{
    log.Warn(@"Too many characters in name."); //Console Warning

    Database data = new Database();
    MySqlCommand cmd = data.CreateQuery();
    cmd.CommandText = "UPDATE accounts SET banned=@banned WHERE id=@id AND name=@name;"; //This bit bans their account.
    cmd.Parameters.AddWithValue("@id", client.Account.AccountId);
    cmd.Parameters.AddWithValue("@name", client.Account.Name);
    cmd.Parameters.AddWithValue("@banned", 1);
    cmd.ExecuteNonQuery();
    data.Dispose();

    client.Disconnect(); //Prevents them from entering the Nexus.
    return;
}

Originally Posted by Invader_Zim

Image

Yes I fixed the typo in "many".

Code:

if (client.Account.Name.Length > 20) //Name Length Detection
{
    log.Warn(@"Too many characters in name."); //Console Warning

    Database data = new Database();
    MySqlCommand cmd = data.CreateQuery();
    cmd.CommandText = "UPDATE accounts SET banned=@banned WHERE id=@id AND name=@name;"; //This bit bans their account.
    cmd.Parameters.AddWithValue("@id", client.Account.AccountId);
    cmd.Parameters.AddWithValue("@name", client.Account.Name);
    cmd.Parameters.AddWithValue("@banned", 1);
    cmd.ExecuteNonQuery();
    data.Dispose();

    client.Disconnect(); //Prevents them from entering the Nexus.
    return;
}

Never knew about this. I'll use it and credit you, thanks. Just curious why you're banning them when it disconnects them already? Seems kind of redundant in my opinion.

Originally Posted by NigrKiller

Never knew about this. I'll use it and credit you, thanks. Just curious why you're banning them when it disconnects them already? Seems kind of redundant in my opinion.

They're not able to change their name back so what's the point of even having the account

Originally Posted by Extain

They're not able to change their name back so what's the point of even having the account

There are actually many ways to allow a name change. But like I said there's no real reason to ban an account for not really doing anything lol

Just adds to the spaghetti code that FSoD is

Originally Posted by NigrKiller

There are actually many ways to allow a name change. But like I said there's no real reason to ban an account for not really doing anything lol

Just adds to the spaghetti code that FSoD is

I agree, Their is no point in banning the account... You can easily just make it so they can't connect or the name can't exceed a certain number of letters!

1) > 20? so yeah i guess we'll still let the "hackers" have a 1-20 character name thats cool:P

2) you went about it a bit the wrong way, no need to even let them get as far as choosing a name any longer than what you want to be the max characters
the hack is done by editing the text inputs coding in the client, changing the max chars allowed to be typed into the box to a higher number
so just make it so that they can't even name the account successfully if the name trying to be chosen is over X chars
like this

Why are you creating a new instance of Database? Why not use the existing one? Why would you check it here instead of checking when they are creating the account like riiged said? So much wrong with this.

Originally Posted by Invader_Zim

Image

Yes I fixed the typo in "many".

Code:

if (client.Account.Name.Length > 20) //Name Length Detection
{
    log.Warn(@"Too many characters in name."); //Console Warning

    Database data = new Database();
    MySqlCommand cmd = data.CreateQuery();
    cmd.CommandText = "UPDATE accounts SET banned=@banned WHERE id=@id AND name=@name;"; //This bit bans their account.
    cmd.Parameters.AddWithValue("@id", client.Account.AccountId);
    cmd.Parameters.AddWithValue("@name", client.Account.Name);
    cmd.Parameters.AddWithValue("@banned", 1);
    cmd.ExecuteNonQuery();
    data.Dispose();

    client.Disconnect(); //Prevents them from entering the Nexus.
    return;
}

It could use improvements, as Riigged and Zeus said, but good work. The idea is great + it brings attention to the bug

I've experienced issues with some things when dealing with writing to the database, but after using another instance for it, everything works fine. I also just repeat things that have worked in the past, since I do not know how to code.

What I did was rushed, I also do not have much experience. Riiged has shown the correct way to go about it, and I've learned from it.

[FSoD] Long Name Hack Fix

Post a Reply

Similar Threads

Tags for this Thread