Duping

Hi, I have play a game called Diablo2, that I looked for in this game are Packets to send to the server to do thinks that you can´t do from the orginal client, using an packet sender. A dupe method that are old for now you simple used it to sell an item from an bugged buffer in your inverntory as many times you whant then buy them all back.


So for your Question about What kinds of things do cheaters look for when trying to find a new duping bug are for this game find packets that are not patched and thinks that ohter people havent found yet ^^.

Consider -

Alyce trades an item to Bob
The server saves Bob's data
The server crashes

When the server comes back up Bob has the item (because he was saved), and so does Alyce (because she wasn't saved).

Ya, that's straightforward enough, but I know that isn't the only way duping has been done and probably not the most common way considering the entire server has to crash.

you could also change the character-data in your memory, if the server doesnt keep an actual copy for itself at runtime or doesnt track if the data the client claims to have is correct you can do what trainers do and change whatever you want... i think if you find some informations about diablo2 you will have a huge ammount of informations/methods to dupe... i think such generated items where tagged with ITH, but cant remember...

another method in diablo2 i think was to kill a person (that will drop a corpse at a specified location) and then somehow kill another person on the same spot caused the previous corpse to explode and drop all items it had...

the best you can do is to encrypt all packets and data that could be used to dupe items, that will make life harder, but not impossible, so watch your community and try to fix such 'bugs' as fast as possible :p

ps: no iam no evil hacker/cracker, i only spend some time wondering on how it could be done...


T2k

T2k, caused the previous corpse to explode and drop all items

There is no items in the corpse only in the corpse&ground buffer so its imposible to make it dropp the items if you not click on it with the character that owns it :p and when you do that it send a reconstruct packet that create the items again or something like that, I read about it somewere can't remeber.

Hahaha the irony.
Look at the last post, from Michalson: <a href="http://www.gamedev.net/community/forums/topic.asp?topic_id=260911>http://www.gamedev.net/community/forums/topic.asp?topic_id=260911

oh nos!1 Nice find Hedos.

Many methods to dupe items will target to exit a transaction (selling items, player/player trading, item pick up/drop, upgrading...) in a non standard way, so some unplaned side effects will happen. And cheater will check if these can be abused in a positive way. This exiting can be arcieved for example by alt-tabbing out and kill the client task, or flood the network so the connection times out, or other bad attacks. (I've heared the alt-tabbing worked in earlier versions of diablo).

If duping cheats could be predicted, the progammer would code them out.

If you want to avoid duping in a game you design, make sure you design ALL item movements (spawn, loot, trade, shops, ...) to use atomic, durable transactions. Easiest is to pull them into a relational database. However, you may need to custom-build something using a durable log if you need more performance than your typical DB will deliver; depends on the scale of the game and your performance needs.

Discussing how to dup in games that do NOT use real transaction semantics for their item management might be somewhat interesting, but also sort-of skirts the line of acceptable. It's OK to say "don't do this" but it's not OK to say "you can make TONS OF PLAT!!! if you ...". Question is: how to tell the two cases apart?

So, if we can focus on how to AVOID duping in your game, that would be the most useful.

The database way of doing it is to use transactions (begin, commit and rollback transaction command)

Before doing anything you start the transaction and do everything in a temp environment.
If everything went well, you commit the changes.
If anything failed or if a timeout occured, you roll back (undo) the changes.

Another thing, is that you might want to flag the transaction items for exclusive use so that no 2 transactions involving the same item can be started at the same time.

Gizz

If you not using transactioning, try the following
1) delete the object from the data store before you add it again. This way if the server crashes niether player has the item
2) Due to the obvious problem with the above, make sure you log all deletes and adds, so if they complain you can fix it.( Players will always complain if they lose something but maybe not if they dupe it)
3) give every item a Unique ID and make sure this is never duplicated in the datastore. ( again tied with number 1, since you can only keep things unique if you don't ever have 2 copies in the datastore at the same time)

Sorry about the duplicate post, this stupid user agreement popped up *after* I hit "back".