|  |
WoW Memory Editing WoW Memory Editing for learning purposes only.
This section is more advanced than others on MMOwned Read the section specific rules, infractions will be given out if u break them!That is including the expectations! - If you don't meet them then don't post |
 | | 
07-14-2009
|  | Knight | | | Join Date: Apr 2009
Posts: 221
Reputation: 11 Level up: 10%, 454 Points needed |   | | | Modifying player position
Hi !
There are some so-called XYZ hacks out there.
AS far as I informed myself they are just add/subtract 0.13 to the players x/y/z position where 0.13 is the highest number which can be added/subtracted without getting problems with the server.
So far, so good.
Are there any routines implemented in WoW to detect that cheat?
Or is it just dangerous if player see someone hacking and report it?
If not...the server wouldn't care if a player is inside a mountain or outside instance walls ?
Thanks. |
Donate to remove ads, get your "DONATOR title, and get access to the MMOwned community's elite Shoutbawx.
07-14-2009
|  | Master Sergeant | | | Join Date: May 2008 Location: Under your bed
Posts: 97
Reputation: 17 Level up: 31%, 345 Points needed | | | | If you're moving faster your speed determines, the server can detect you without anything on the client side (no need for warden, or any other detection mechanism). This includes teleport hacks, and speed hacks.
If you're no-clipping, the server can again detect you at any time. Blizzard knows it's world boundries. It knows where the player can (should) be, and where it can't (shouldn't) be.
Doesn't need to be client side detection for any of this. it can all be done on the server side, which we all have no idea what is going on behind the curtains. |
07-14-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 766
Reputation: 20 Level up: 31%, 629 Points needed |  | | | Boogieman, could you propose a method that they would use to detect speedhacking? I know in private servers, they check the difference in actual serverside tickcount between the packets(seems unreliable due to lag). |
07-14-2009
| | Master Sergeant | | | Join Date: May 2008 Location: Under your bed
Posts: 97
Reputation: 17 Level up: 31%, 345 Points needed | | | Quote:
Originally Posted by lanman92  Boogieman, could you propose a method that they would use to detect speedhacking? I know in private servers, they check the difference in actual serverside tickcount between the packets(seems unreliable due to lag). | Most common speedhack seems to be sending movement packets at a higher rate than they're supposed to be sent. each movement heartbeat is supposed to be 500ms apart from the last one, EXACTLY, not 1-2 ms off. You can compare the last heartbeat (server time), with a new incoming one, and they must be >= 500 (including lag factor). If they're less, they're obviously cheating.
so you're basically ignoring the timestamp in the packets, and verifying it in your server's real time that you know is accurate, and not effected by lag. Server also knows quite a bit about your lag, too. It's syncing up all the time with pings and other packets to verify your timestamp to compensate for lag. Emulators don't do this very well, so their anti cheat's don't work 100% (they also don't factor in alot of speed modifiers, which trigger false-positives). The above method should work just fine for them, too, though.  |
07-14-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 766
Reputation: 20 Level up: 31%, 629 Points needed | | | | Well. WoWInfinity only increases the rate of outgoing packets, not changing the timestamp. Is this why they're undetected? I'm still stumped at why the server isn't accepting my movements... Pfft. |
07-14-2009
| | Master Sergeant | | | Join Date: May 2008 Location: Under your bed
Posts: 97
Reputation: 17 Level up: 31%, 345 Points needed | | | Quote:
Originally Posted by lanman92 Well. WoWInfinity only increases the rate of outgoing packets, not changing the timestamp. Is this why they're undetected? I'm still stumped at why the server isn't accepting my movements... Pfft. | WoWInfinity is most definitely vulnerable to the detection I mentioned then. As that's exactly what I'm talking about.
If your packets claim they're 500ms apart, yet in reality they came over the wire 50ms aparts, something is up.. You'd still have to keep an eye on the packet timestamps (and the client timestamp syncup), just to make sure it was just a lag spike and a bunch of packets flowed in at once, but it's still a pretty easy detection (at least to flag the account) mechanism to implement |
07-14-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 766
Reputation: 20 Level up: 31%, 629 Points needed | | | | Ah. I wasn't sure if you meant packet timestamp or actual timestamp. Is there any detection like this in place? I know warden is somehow sensing it, but I'm not too worried about that. Will be pretty bad luck if it scans right as I teleport.
EDIT: Scratch that. Gonna be a nono to do russian roulette with my account...
Last edited by lanman92; 07-14-2009 at 07:58 PM.
|
07-14-2009
| | Knight-Lieutenant | | | Join Date: Jan 2008
Posts: 275
Reputation: 17 Level up: 21%, 558 Points needed | | | Quote:
Originally Posted by lanman92 Ah. I wasn't sure if you meant packet timestamp or actual timestamp. Is there any detection like this in place? I know warden is somehow sensing it, but I'm not too worried about that. Will be pretty bad luck if it scans right as I teleport.
EDIT: Scratch that. Gonna be a nono to do russian roulette with my account... | Warden's scanning function is called constantly. |
07-14-2009
| | Master Sergeant | | | Join Date: May 2008 Location: Under your bed
Posts: 97
Reputation: 17 Level up: 31%, 345 Points needed | | | Quote:
Originally Posted by ramey Warden's scanning function is called constantly. | every 15 seconds, actually. plenty of time to slip in between scans. |
07-14-2009
| | Knight-Lieutenant | | | Join Date: Jan 2008
Posts: 275
Reputation: 17 Level up: 21%, 558 Points needed | | | Quote:
Originally Posted by BoogieManTM every 15 seconds, actually. plenty of time to slip in between scans. | I did say Warden's scanning function. |
07-14-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 766
Reputation: 20 Level up: 31%, 629 Points needed | | | | I'm guessing that the modules can have delayed loads/execution though? |
07-20-2009
| | New User | | | Join Date: Jun 2009
Posts: 7
Reputation: 1 Level up: 25%, 302 Points needed | | | | If speedhacking is so detectable, how come so many people are successfully doing it? Wowfinity claims it cant be detected by Warden. |
07-20-2009
|  | MaiN's Biatch Legendary User | | | Join Date: Mar 2007 Location: VirtualAllocEx
Posts: 1,115
Nominated 26 Times in 3 Posts  TOTM/W Award(s): 1 Reputation: 727 Points: 36,171, Level: 28 | Level up: 95%, 129 Points needed | | | | Because they do it in à fashion as discussed here.
But that doesnt mean its less detectable of blizzards they could just start measuring how fast clients send movement packages but im not sure if they could do it accurqtly enough to catch speedhackers. Suppose they do implement some new features to catch speedhackers imagine ppl getting banned for lagging. |
07-20-2009
| | Sergeant | | | Join Date: Apr 2008
Posts: 49
Reputation: 50 Level up: 16%, 420 Points needed | | | Quote:
Originally Posted by BoogieManTM If you're moving faster your speed determines, the server can detect you without anything on the client side (no need for warden, or any other detection mechanism). This includes teleport hacks, and speed hacks. | Since the movement packets you receive from other players contain the timestamps, too. You could even create a speedhack detection tool on your own client.
For example a log from a Wintergrasp speedhack farmer:
my time: 0x11f99450
speedhacker time: 0x995a699a
... more packets from him ...
speedhacker time: 0x995a82fe
my time: 0x11f99644
500ms for me equals 6500ms for him, a little bit to large the gap ; ) It still baffles me why they can't effectively stop those speedhack farmers. |
07-20-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 766
Reputation: 20 Level up: 31%, 629 Points needed | | | | There could be a massive threshold, but again, people would get banned for lag. The most they could probably do for that is disconnect and monitor you. For ex, that person is lagging so bad(router is locked up?), and they reconnect, the flood of packets will come flying and their time would be off compared to yours. | | |
Posting Rules
| You may not post new threads You may not post replies You may not post attachments You may not edit your posts
HTML code is Off
| | |
All times are GMT -4. The time now is 07:24 PM.
|
