Not for nothing, but this is how all the CS cheating began. With only a few simple cheats and now it seems everyone on the CS servers cheat. Of course, I don't see any fun in that, but is it possible UT may be heading in that direction?
what is epic planning to do about aimbot?
- Thread starter thewalkingman
- Start date
-
Two Factor Authentication is now available on BeyondUnreal Forums. To configure it, visit your Profile and look for the "Two Step Verification" option on the left side. We can send codes via email (may be slower) or you can set up any TOTP Authenticator app on your phone (Authy, Google Authenticator, etc) to deliver codes. It is highly recommended that you configure this to keep your account safe.
well, Sin
you got an idea of how to import a fire texture via exec commands? You can only import it in via a utx file. and then the pallette class will get changed. The only way to confirm the package as far as I know is via ucc. so you're still screwed. I know they are package based, so the one in object is just that? but like I said, the palette would get screwed up if you reimported the texture. Besides there are plenty of privates in there too....
). And know of a source ripper.
Maybe, but remember that the package needs to be recompiled to bypass it. and maybe the calculations can all go on via a object (not actor). As far as I no, there are no way to get private vars (well, if you know then e-mail me at usaar33@yahoo.com).
either way its stronger security than cshp. Besides the real things its got is the admin interface and the skin/model code.
[Edited by usaar33 on December 22nd, 2000 at 12:46 AM]
Maybe I lost myself, but then again this is coming from someone spelling "yourself" "yuorself".
you got an idea of how to import a fire texture via exec commands? You can only import it in via a utx file. and then the pallette class will get changed. The only way to confirm the package as far as I know is via ucc. so you're still screwed. I know they are package based, so the one in object is just that? but like I said, the palette would get screwed up if you reimported the texture. Besides there are plenty of privates in there too....
well, you first need to know how to confirm packages (isn't very well documented
). And know of a source ripper. last time I checked, he was using the hole that can't be closed, at least by yours...
Maybe, but remember that the package needs to be recompiled to bypass it. and maybe the calculations can all go on via a object (not actor). As far as I no, there are no way to get private vars (well, if you know then e-mail me at usaar33@yahoo.com).
either way its stronger security than cshp. Besides the real things its got is the admin interface and the skin/model code.
[Edited by usaar33 on December 22nd, 2000 at 12:46 AM]
Thats an interesting measure of intelligence you've worked out there... Unfortunatly it doesn't seem to be very accurate or precise.
I wont even bother explaining how you can get around this, its so simple. Plus I dont want to give people ideas on how to compromise any system.
a)
confirm packages? Hmm, following the intelligence rating system you used above to judge DrSiN - that error would make you a moron.
b)
Code:
=======================================
ucc.exe: UnrealOS execution environment
Copyright 1999 Epic Games Inc
=======================================
Usage:
ucc conform existing_file.ext old_file.ext
Parameters:
existingfile.ext Existing binary file to load, conform, and save
oldfile.ext Old file to make source file binary compatible withAnd yet you beleive you are impervious to this as well?
Splendid. That way you won't be able to replicate any of the calculations!
From my point of view, it doesn't matter if your vars are private, since all hacks will be done in the class itself.
Its no stronger than CSHP. Its vulnerable to EXACTLY the same hack. NO System is unhackable - its mathematically impossible. I doubt yours will last very long, from what I've read about it in this thread.
--Yoda
PlanetUnreal
[Edited by Yoda on December 21st, 2000 at 03:40 PM]
WOW!, That was Waaaaaaaaaay over my head. I don't know who you guy's are, but you sure know alot about UT. Mabe if you put your skills together, you could find a real soultion to the cheating problem and make alot of people very happy, But I'm sure you'll just keep quoting each other.. Either way, Good luck.
I was thinking the same thing Nettone. If they worked together on a cheat fix they'd probably accomplish alot more.
hehe
now its 2v1. let's join the assault against me
(and I was referring that the hacker (not Dr. Sin, I suppose a chose the wrong pronoun would need to know how to do that. I only knew of putting the old file in system conform. They just keep adding on commandlets don't they? (and then I suppose this has been around since 400). I never relized how many have been added since unreal I).
Thank you for reading my rant. Feel free to flame me.
now its 2v1. let's join the assault against me
I was simply being sarcastic, nothing more. I'm not saying anyone is smarter than anyone.
I'm a moron! that's nice. I've always wanted to be one
(and I was referring that the hacker (not Dr. Sin, I suppose a chose the wrong pronoun would need to know how to do that. I only knew of putting the old file in system conform. They just keep adding on commandlets don't they? (and then I suppose this has been around since 400). I never relized how many have been added since unreal I).to plugging in the bot in an epic package, yes. But once the code is changed around in ezteams, any aimbot is will work. Yet, the same is true for cshp. If Epic wouldn't give out the amount of information that they have on their package format, perhaps source decompilers wouldn't exist. Yet they do, which means total security is impossible...
well, its not my package anyway. It's darkbyte[s&d]'s. Yes no system is unhackable. The goal is simply to increase the difficulty. It is vulnerable to a user rebuilding itself, but not to an aimbot being put in a standart epic package.
uh, it can call a replicated function in an actor. And there are other ways to kick a client besides telling the server to do so. Just have a while(true) loop. It'll simply crash the client (or lock it up if the loop is so enough for UT never to catch it). this is A) more annoying to the would-be hacker and B) prevents messing around with variables and C) slows the hacking down (at least 2 minutes will be needed to catch the iterator or the would be hacker might just reboot (which on my comp requires ~ 3 minutes). Yet the real advantage of ezteamsv4 will be the lack of false positives. It can tell if a client-side mod is an aimbot or not. Thus people will be able to hapily use decalstay, nosmoke, oldskool, etc. while not worrying about bots. I do relize though that there are other cheats though aside of aimbots. Yet seeing that they are unreleased and probably bypass cshp anyway, I do not view it as a big deal. (the anti-bot code BTW was started before Sin's version of cshp that had a simple mode, so other mods wouldn't be targeted). I'm not saying ezteams is invulnerable. It has only one hole though, while cshp has two. And with its other features (stopping users from bruteforcing admin passwords and preventing the broadcast and broadcastlocalized message calls), it tends to be a better choice. (and security is only a tiny part. I might add admin bots, a different skin replication system (allow clients to recieve meshes and skins as strings so they can dynamically load it, allowing the server to not need the skin/model for a client to use it. It ought to help the skin community out a LOT. And of course the admin interface. So even if the security part fails, at least the mod will still be quite useful.
Thank you for reading my rant. Feel free to flame me.
SimplyCosmic
ERGO. VIS A VIS. CONCORDANTLY.
There. That aught to take care of the ugly turn "heated debates" about competing projects can quickly take.
Actually, I kind of like the fact that there's more than one attempt at anti-hacking. As we all know, there's no such thing as a hack-proof scheme. Might as well make it that much harder to overcome different approaches to the problem, than to have one single entity to attack.
However, right now, my money's on Dr. Sin.
Anytime I hear someone claim to have an unsinkable solution to a security problem, I start thinking Titanic.
SimplyCosmic
ERGO. VIS A VIS. CONCORDANTLY.
What do you mean coming? Feck, the flamethrowers and molitov cocktails were out and flying about a page back.
Actually, this commandlet was introduced at the same time as the rest of the conform stuff.
I'm not sure just exactly how you're planning to acheive this.
Again.
Actually, it takes about 3-4 SECONDS for UT to figure out its in a runaway loop. Plus it tells you the function responsible for it.
I highly doubt people will use it, if lots of people start bypassing it.
In any case, I accept the challenge you proposed a few posts eariler. I give it 1-2 hours, max.
--Yoda
PlanetUnreal
HMMM..
I have experienced some major lag lately playing instagib am I experiencing something with this aimbot deal...what ever this aimbot is, I wouldn't know what a aimbot is if it jumped up and fragged me....lol
I have experienced some major lag lately playing instagib am I experiencing something with this aimbot deal...what ever this aimbot is, I wouldn't know what a aimbot is if it jumped up and fragged me....lol
The aimbot will not cause lag for you.
And if you want to know if a person is using it, just switch to hisher team and stand behind him/her!! They will keep spinning around to try and shoot you. The aimbot can't tell the difference between friend and foe!!
And if you want to know if a person is using it, just switch to hisher team and stand behind him/her!! They will keep spinning around to try and shoot you. The aimbot can't tell the difference between friend and foe!!
Remember the scene from The Simpsons where Lisa tries to reconcile Krusty the Clown with his father who is a Rabbi?
I think we stumbled on Part 2
I think we stumbled on Part 2
ok Yoda.
first of all I'm talking about better bots that have team checks.
second, SC, that cat isn't ugly. I'd like one like that! I'm not claiming the protection is without holes, just less than cshp.
And Yoda, while I have no idea how you ever got involved here, I will continue on:
[Edited by usaar33 on December 22nd, 2000 at 12:44 AM]
first of all I'm talking about better bots that have team checks.
second, SC, that cat isn't ugly. I'd like one like that!
I'm not claiming the protection is without holes, just less than cshp. And Yoda, while I have no idea how you ever got involved here, I will continue on
:That would be when? And I know it wasn't in unreal 2.26 (it only has make, master, masterserver, and a couple other server related ones...). And what conform stuff? Are you referring to the systemconform directory or what?
As I said before, Ezteams is searching for an unauthorized change (where an allowed one would be via keyboard/mouse inputs, a teleporter, respawing, or using a redeemer) to the viewrotation. CSHP searches for client-side actors not allowed by the server. And someone of your intelligence can easily figure out how it won't break harmless (that is non-aimbot) mods and also stop the err..um...method cshp has wholes in...
that is not entirely true. In a empty function, yes. You just add stuff in like traces. I've seen this bug before. It will pretty much never catch it (the railgun's loop (legacy) that had a bad trace call inside it was never detected in even an hour. and since the log is wiped...
That's like saying that servers shouldn't be using cshp anymore! And we'll see how long it takes you. And if you bypass it the non-cheap way (decompiling the source with some function ripper), then you are truly the 1337 uscripter
[Edited by usaar33 on December 22nd, 2000 at 12:44 AM]
Here's the output of 'ucc help' for Unreal 226:
Code:
=======================================
ucc.exe: UnrealOS execution environment
Copyright 1999 Epic Games Inc
=======================================
Usage:
ucc <command> <parameters>
Commands for "ucc":
ucc conform Generate conforming binary files
ucc help <command> Get help on a command
ucc make Rebuild UnrealScript packages
ucc master Build master installer files
ucc masterserver Maintain master list of servers.
ucc server Network game server
ucc updateserver Service Unreal Engine auto update requests.This needs to be done client side, and thus _TOTALLY_ vulnerable.
I will use nothing but an install of UT, with whatever files Epic provides applied to it (Patches etc), my fingers, and a bit of logic and programming.
--Yoda
PlanetUnreal
posted 7 minutes after mine. not bad!
hehe.
as for the ucc output, mine has all those but the first (command). then again I was checking the napali 226 ucc. The patch came out later, so uh.. that's just messed up
hehe.
as for the ucc output, mine has all those but the first (command). then again I was checking the napali 226 ucc. The patch came out later, so uh.. that's just messed up
did I say it was invulnerable? no. It just stops false positives and closes one of cshp's holes. cshp has many though. And I'm sure ezteams will have some to.
very well. I could probably get darkbyte to send it to you (source wiped of course) now and set up a server
I responded to some of this in private email but I'll response to some here.
I don't have a problem with DarkByte working on anti-cheating protection. In fact, I welcome it. Anything that helps is a good thing. People should run both and any others that come along.
I do have a problem with the way your representing it. There is only a certain level of security that someone can reach in Uscript. CSHP is as strong as USCRIPT security can get. Is it infalable? No. However if someone does find one of the several ways to bypass CSHP, they break that top level and can bypass anything done strictly in uscript.
I'll give you an example. Using viewrotation is hardly the only method of writing an aimbot. But you haven't thought of that have you? Using a console hack, I could quickly code something that would give your protection 100% authentic results that you could never detect or never stop.
Remember, I didn't write CSHP overnight. It was 6 months in development before the first release ever occured and it's now going on a year old. The avenues you are taking are not new. They're just are easilly exploitable.
As for the need to shut down other unauthroized hacks, there is simply no way around it. Because of the people's need to cheat, some mods simply aren't worth the risk. Sorry to say OldSkool is one of them. It has nothing to do with the mod and I'm sorry you take it personally. But by allowing ANY unauthroized mod you allows for cheating.
For example, what happens when I create a bot from a client-side level actor that uses the default UTConsole to bypass your protection. This bot would take 5 mins to write and would be completely undetectable by your code.
CSHP would see it right away and kill it. But if I allow the client to decide what mods are kosher, then nothing stops me from creating this bot in the package OldSkool (or whatever your package is) and spoofing right by it.
I don't have a problem with DarkByte working on anti-cheating protection. In fact, I welcome it. Anything that helps is a good thing. People should run both and any others that come along.
I do have a problem with the way your representing it. There is only a certain level of security that someone can reach in Uscript. CSHP is as strong as USCRIPT security can get. Is it infalable? No. However if someone does find one of the several ways to bypass CSHP, they break that top level and can bypass anything done strictly in uscript.
I'll give you an example. Using viewrotation is hardly the only method of writing an aimbot. But you haven't thought of that have you? Using a console hack, I could quickly code something that would give your protection 100% authentic results that you could never detect or never stop.
Remember, I didn't write CSHP overnight. It was 6 months in development before the first release ever occured and it's now going on a year old. The avenues you are taking are not new. They're just are easilly exploitable.
As for the need to shut down other unauthroized hacks, there is simply no way around it. Because of the people's need to cheat, some mods simply aren't worth the risk. Sorry to say OldSkool is one of them. It has nothing to do with the mod and I'm sorry you take it personally. But by allowing ANY unauthroized mod you allows for cheating.
For example, what happens when I create a bot from a client-side level actor that uses the default UTConsole to bypass your protection. This bot would take 5 mins to write and would be completely undetectable by your code.
CSHP would see it right away and kill it. But if I allow the client to decide what mods are kosher, then nothing stops me from creating this bot in the package OldSkool (or whatever your package is) and spoofing right by it.
ok....
As I start from the beginning I can see how much more of an @$$ I've become throughout these postings.
I don't see a better way at all. viewrotation is what weapons read after all for start traces... (and I don't think there is anything wrong with letting people see servermove. That is very important code to know).
. I congradulate you though with the new version which simply destroys rogue actors. Now if only admins would run it....
I believe I said this as well earlier. I guess flaming tends to increase my arrogance expodentially.
As I start from the beginning I can see how much more of an @$$ I've become throughout these postings.
Actually I have thought of it. Darkbyte claims to have some security against this (assuming we are speaking about the same thing, I won't mention it however). I haven't seen it all myself, thus I'm only taking his word on it. And yes, as far as I know all aimbots would be rooted in viewrotation (just not need a direct change).
Code:
function ServerMove
(
float TimeStamp,
vector InAccel,
vector ClientLoc,
bool NewbRun,
bool NewbDuck,
bool NewbJumpStatus,
bool bFired,
bool bAltFired,
bool bForceFire,
bool bForceAltFire,
eDodgeDir DodgeMove,
byte ClientRoll,
int View,
optional byte OldTimeDelta,
optional int OldAccel
)yes, but the irony is that without funbot, cshp was never used. never forgot that your ways are exploitable too. how much more or less? That is quite hard to judge.
hey, if I knew about cshp in advance, I would've had a nice option to disable the actor. Yet I didn't. Once I get things worth having a new release, then I'll release it. But it has caused many to uninstall oldskool. I only can fear what happens with legacy and onp, which depends on the mod
. I congradulate you though with the new version which simply destroys rogue actors. Now if only admins would run it....What makes it undetectable? And cshp runs foreach allactor iterator loops client-side, so nothing is stopped there. I suppose nothing can ever stop client-side hacks