Originally Posted by nilly
Edit: On second thought, might be possible.
Originally Posted by nilly
Possible RotMG God Mode?
Originally Posted by nilly
Took a look at the max damage idea. It won't work. As it turns out the randomness of the numbers isn't really random. It works off a seed that is generated in a predictable manner. What this means is the server knows what damage each projectile should do. So in short, server sided.
Edit: An interesting note is, if it works as I think it does, any kind of lag would cause the seed to get out of sync with the server causing your client to report a damage that isn't really happening. That is unless the client sends the number of projectiles shot. Which would be interesting.....
Edit: Another possiblilty is if lag occurs then those shots fired in lag would eventually be registered with the server somehow. I don't know what information is really sent via packets (especially when lag occurs) so I can't really answer which case is the way it really works.
Edit: An interesting note is, if it works as I think it does, any kind of lag would cause the seed to get out of sync with the server causing your client to report a damage that isn't really happening. That is unless the client sends the number of projectiles shot. Which would be interesting.....
Edit: Another possiblilty is if lag occurs then those shots fired in lag would eventually be registered with the server somehow. I don't know what information is really sent via packets (especially when lag occurs) so I can't really answer which case is the way it really works.
Originally Posted by nilly
Took a look at the max damage idea. It won't work. As it turns out the randomness of the numbers isn't really random. It works off a seed that is generated in a predictable manner. What this means is the server knows what damage each projectile should do. So in short, server sided.
Originally Posted by flyrocket
So that is probably why there is the "bulletId" int in the ENEMYHIT Packet and not damage done. For some reasons spell bulletId hits are negative though
The server might think you're speed hacking if it sees the bulletId's change so rapidly.
---------- Post added at 05:15 AM ---------- Previous post was at 05:06 AM ----------
Hey @flyrocket, I was looking at the code and noticed bulletId_ is a unsigned int. That explains why you are seeing negative numbers.
Originally Posted by nilly
This is interesting. I imagine they have to deal with lag some how as one can still shoot in lag. Maybe the bulletId is generated in such a way to let the server know what number projectile you are firing. If that is the case then it might be possible to modify the bulletId to ones that provide max damage.
The server might think you're speed hacking if it sees the bulletId's change so rapidly.
The server might think you're speed hacking if it sees the bulletId's change so rapidly.
When you shoot, it sends a playershoot packet which also contain your bulletId (which is a sequential count of your bullets from when you entered the world), and when you hit someone, it's the same bulletId which you fired.
Still unsure about the negative spell bulletIds though.
EDIT: Ahhh, lemme fix that and see what happens
Just looked at the bulletId_.... it is the projectile number fired. 
This might be exploitable.
---------- Post added at 05:28 AM ---------- Previous post was at 05:24 AM ----------
Originally Posted by flyrocket
I'm almost positive the bulletId_ tells the server how much damage you should be doing (the randomness between min damage and max damage). There might be other checks on it to see that your not speed hacking or what not. You ever tried manipulating them?
This might be exploitable.
---------- Post added at 05:28 AM ---------- Previous post was at 05:24 AM ----------
Originally Posted by flyrocket
Actually, when thinking about it and digging deeper, I think the IDs are so the server can determine your bullet projectile and if you actually hit the mob.
When you shoot, it sends a playershoot packet which also contain your bulletId (which is a sequential count of your bullets from when you entered the world), and when you hit someone, it's the same bulletId which you fired.
Still unsure about the negative spell bulletIds though.
EDIT: Ahhh, lemme fix that and see what happens
When you shoot, it sends a playershoot packet which also contain your bulletId (which is a sequential count of your bullets from when you entered the world), and when you hit someone, it's the same bulletId which you fired.
Still unsure about the negative spell bulletIds though.
EDIT: Ahhh, lemme fix that and see what happens
Originally Posted by nilly
Just looked at the bulletId_.... it is the projectile number fired.
This might be exploitable.
---------- Post added at 05:28 AM ---------- Previous post was at 05:24 AM ----------
I'm almost positive the bulletId_ tells the server how much damage you should be doing (the randomness between min damage and max damage). There might be other checks on it to see that your not speed hacking or what not. You ever tried manipulating them?
This might be exploitable.
---------- Post added at 05:28 AM ---------- Previous post was at 05:24 AM ----------
I'm almost positive the bulletId_ tells the server how much damage you should be doing (the randomness between min damage and max damage). There might be other checks on it to see that your not speed hacking or what not. You ever tried manipulating them?
you know what's cool? open two rotmgs, get both in same server, one to watch the effect. speedhack one with cheat engine, get a bulwark, autofire, speedhack (hotkey something to 30x, and another key to 1x) to 30 or something, aim in a circle, watch.
you'll fire loads of bulwarks, real projectiles not fake ones. you get dc'd shortly after.
you'll fire loads of bulwarks, real projectiles not fake ones. you get dc'd shortly after.
My theory went down in flames. The order of the seed isn't how I guessed it would be. Maybe it doesn't start at 0...
Originally Posted by nilly
My theory went down in flames. The order of the seed isn't how I guessed it would be. Maybe it doesn't start at 0...
Code:
_as3_getproperty bulletId_ //4f e2 0d 01 _as3_callpropvoid flash.utils:IDataOutput::writeByte(param count:1)
EDIT:
I tried changing the bulletId of enemyhit to a only be 1, mobs die on your screen, but aren't really dead, d/c.
I tried changing playershoot to only be 1 and enemyhit to only be 1, same thing as above.
I tried changing enemyhit to bulletId += 5 to see if it relied on playershoot's id, same thing.
If you want me to try anything else, let me know. I don't really know what to try, lol.
You confused me there... the bulletId_ is passed to a function called writeByte. You are reading with something like readByte? Is this a question about the type?
Anyways I discovered that the seed is set when you enter realm/nexus/vault/dungeon (whenever you change servers). So it doesn't start at 0 like I originally thought. I'm going to try and manipulate bulletId_ and see if I get kicked or not.
Anyways I discovered that the seed is set when you enter realm/nexus/vault/dungeon (whenever you change servers). So it doesn't start at 0 like I originally thought. I'm going to try and manipulate bulletId_ and see if I get kicked or not.
Originally Posted by nilly
You confused me there... the bulletId_ is passed to a function called writeByte. You are reading with something like readByte? Is this a question about the type?
Anyways I discovered that the seed is set when you enter realm/nexus/vault/dungeon (whenever you change servers). So it doesn't start at 0 like I originally thought. I'm going to try and manipulate bulletId_ and see if I get kicked or not.
Anyways I discovered that the seed is set when you enter realm/nexus/vault/dungeon (whenever you change servers). So it doesn't start at 0 like I originally thought. I'm going to try and manipulate bulletId_ and see if I get kicked or not.
I don't even think java has unsigned int data type to begin with (time to google). Lemme mess around some more, and i'll see what happens.
Anyways, since spells don't seem to be related to the playershoots bullet id, you can try manipulating it so every bullet hits the mob.
EDIT: I tried doing the spell thing with packets, but it is still d/cing. I am sending 20 enemyhit packets and making sure my spell use position is the same a the enemies.
Anyways, bulletIds cycle from 1 to 127 over and over (for playershoot and enemyhit); when you use your spell, it starts from 128-255
Ok looked a little closer and I see where you are coming from @flyrocket. The data that is sent out is just a byte even though bulletId_ deeper inside the code is an unsigned int. I also recreated the problem you had with changing the bulletId_ (by changing the byte that is sent out to the servers). I'll shoot at things, it looks as if they die but I see the red dots on my mini-map surrounding me. Once they do enough damage I'll get kicked.
I did a another test to see how bulletId_ reacts to lag by unpugging my internet connection for a short time while shooting and then plugging it back in. I noticed even as I was shooting with no connection the bulletId_ was increasing.
I still think that manipulating the bulletId_ variable might work to our advantage. The problem I think lies in the fact that the bulletId_ is used in other parts of the client. By changing the outgoing value, we create an incongruency in what the client is doing and what the server is doing. This is why we were getting odd results when changing the number. I think by digging a little deeper into the code and changing the bulletId_ at the place the value gets updated, the client and the server will recieve the same bulletId_ and react (hopefully) the way we expect it should.
I did a another test to see how bulletId_ reacts to lag by unpugging my internet connection for a short time while shooting and then plugging it back in. I noticed even as I was shooting with no connection the bulletId_ was increasing.
I still think that manipulating the bulletId_ variable might work to our advantage. The problem I think lies in the fact that the bulletId_ is used in other parts of the client. By changing the outgoing value, we create an incongruency in what the client is doing and what the server is doing. This is why we were getting odd results when changing the number. I think by digging a little deeper into the code and changing the bulletId_ at the place the value gets updated, the client and the server will recieve the same bulletId_ and react (hopefully) the way we expect it should.
Well I did what I wanted to do. I'm not sure if it works or not. It basically changes the bulletId_ properly to ones that produce high damage. I haven't been kicked using it so I'm sort of puzzled. If it didn't work I figured I would get kicked after a couple mins of use. I opened up two clients to look at the damage output on another client and it read much lower that what I was seeing on the hacked client so this leads me to believe that it didn't work. The only other thing I can think of is that the bulletId_ cycling got out of sync which would produce those results. Needs more testing...
@flyrocket Do you know if the DAMAGE packet is the one that sends to your client all damage done to players/mobs? I was curious if damage by other players/to other players was calculated client side or if the actual damage numbers were sent to ones client.
@flyrocket Do you know if the DAMAGE packet is the one that sends to your client all damage done to players/mobs? I was curious if damage by other players/to other players was calculated client side or if the actual damage numbers were sent to ones client.
Originally Posted by nilly
Well I did what I wanted to do. I'm not sure if it works or not. It basically changes the bulletId_ properly to ones that produce high damage. I haven't been kicked using it so I'm sort of puzzled. If it didn't work I figured I would get kicked after a couple mins of use. I opened up two clients to look at the damage output on another client and it read much lower that what I was seeing on the hacked client so this leads me to believe that it didn't work. The only other thing I can think of is that the bulletId_ cycling got out of sync which would produce those results. Needs more testing...
@flyrocket Do you know if the DAMAGE packet is the one that sends to your client all damage done to players/mobs? I was curious if damage by other players/to other players was calculated client side or if the actual damage numbers were sent to ones client.
@flyrocket Do you know if the DAMAGE packet is the one that sends to your client all damage done to players/mobs? I was curious if damage by other players/to other players was calculated client side or if the actual damage numbers were sent to ones client.
The damageAmt parameter in the DAMAGE packet has nothing to do with the deduction of the mob's HP, hence why there is a "kill_" bool in the damage packet too. I've been blocking all damage packets in my proxy to help minimize lag for a while now, enemy's HP is updated via NEW_TICK.
Anyhow, I still think the spell idea SHOULD work, i'll keep trying a few things and let you know the outcome. Although I feel like it is much easier to do this with the swf rather than the proxy.
