NWNX Enforce Legal Character

[Makazasky]

Anyone know if it is possible to cast an illegal spell?.... should there be a check in this plugin for spell gained?

[FunkySwerve]

Yes, from what I've been told they can replace the bic entrirely, which also gives them the option of adding items, etc.

Funky

[ronchese]

They can start with ANY stat, any skill and even export a char already equipped and even with plenty of hacked items on inventory (UBER items - just to recall...... they can start with a PASSPORT also, for sure).

I had players that know how to do it, they were from a specific country I guess I can't tell here, but they know A LOT from NWN bugs (they can copy your items just looking in the barter screen; they can restart my server at will; they can jump to locations; they can make themselves invulnerable; etc)

I banned their IPs, it seems they have static IP, because I never saw them anymore

[Makazasky]

[virusman]

At least half of these things are possible.

[ronchese]

Not hard to imagine how they do it. But I can't tell how they do it, here in the forums, otherwise we will have more other guys that will know how, and it should be a further MESS.

The only two part I dont know how they do is:
- they can jump to locations;
- they can make themselves invulnerable.
Me and other DM checked their inventories. The only items they had were weapons with several OnHit Cast Spell and etc. No DM wands or like. And, DM stuff are destroied if used by normal players in my mod. They off course are hacking by other ways.

About exporting character, copying items from bater screen and resetting the server, all of these are easy to imagine how they do. I know the "what to do", not the "how to do".

[virusman]

I'm currently working on fixes for these bugs (the ones I know how to reproduce) and submitting them for 1.69. So if you know how to reproduce any of the mentioned exploits, please let me know.

[Makazasky]

let me know too

[Makazasky]

That can seem out of subject ...
but i have updated this plugin. I have fixed some bugs and improved the application to convert 2da. It now let you call the plugin function to scan a character or your entire servervault outside nwn.

So you can right now know who are the cheater on your server

[ronchese]

I'm trying to PM the information to virusman, but an error occurs on send message (I'm glad I have copied the content to Notepad before I click the Submit button hehe).

The error message is:

---------------
General Error

Failed sending email :: PHP ::

DEBUG MODE

Line : 234
File : emailer.php
----------------

[virusman]

I've received the message. It just couldn't notify me by email (sendmail appears to be broken on this forum).

[ronchese]

Ok.

[Makazasky]

If players can really enter on the server with custom items.... they can surely do whatever they want using the tag base script system...

[ronchese]

Oh Yeah. As far they know the tags, it will become a paradise. Specially if you dont know all items tag-activated existant in your module, meaning will be hard to find all them to apply anti-exploit fixes.

[Makazasky]

I find out how to replace a new character by any local character file and nwserver doesn't allow character with experience, an invalid quantity of gold or custom items.

Althought, i could custumize my character stat even more... i could take any class, race, skill rank...