aguy

Aaaaand ... you are still here ... What happend to that important work you have to do on Sunday ? How about you get on your trike and go do that work eh ?

You already said your previous post was the last one and that you won't post again. Why are you posting again especially if you have work ? And it's Sunday, atleast I don't need to work on Sundays, and I'm not even a highly priviledged white collar worker. You look like an educated, knowledgable person, if you have work on Sunday, you better re-evaluate some life priorities ...

Tell me the pack you are using and you consider high quality. I wanna use it too. I'm using L2JMobius and the pack is simply not production-ready. I am looking for a pack that I can use to make a server without having to worry about every hacker around. Some posts above, another hot headed debater, Atumenos, made similar claims to you, yet once I told him to reccomend me a secure pack to use, he vanished. So question is, are you an all-talk-no-action chicken like him too 😆 ?

Aren't you the friend of the scammer who was selling free L2JMobius (Classiclude) as an advanced private pack ?

Again: Tell me the name of your pack and let's see how secure it is. It's unfair that public packs get all the blame since they are in the forefront of exposure. Name of the pack, source or jar location and I'm happy to waste my tokens on yours to help the community with fixes. After all I dont need them anywhere else, I'm a bus driver. It's funny how when you run out of arguments, you start with the insults on my occupation. If your pack is SO secure, you have nothing to afraid from a bus driver with a Claude Max subscription. Name the pack, I'm waiting.

It's correct that at the right hands these tools can augment visibility and tracing of issues. But only if your priority is to look for these issues. The problem is that nobody seems to be looking. AI won't magically tell you once you open a random context, hey you have race condition there, an invalid state there, a threadlock there. It needs investigation. So far the evidence we have from the open source packs is that their developers are not activelly looking. Check my other thread about how to dupe adena in L2JMobius. Confirmed exploit ingame, 2 lines patch, he didn't even bother to fix it. Previous exploit about adena dupe in his pack, same thing, reported exploit, reproduced, patch shared, only applied it after enough pressure and countless of arguments with his team so as they finally get to understand how it works. Now regarding patching and contributing. The nature of patching and contributing has changed. It's more valuable to investigate, prompt the right questions and instructions, find and validate an issue, than sharing the patch. The patch is easy to generate once the exploit is shared. Some people operate under the assumption that we will hand-feed them PR requests for issues they have caused themselves. You are wrong to believe that AI tools will make the code more secure. Here's where we disagree. The tools are only good for what you use them for. Most people use them to prototype things, get them to "just work". There's tons of new code created this way every day, that simply there's not enough manpower to use the AI tools to do security analysis. To put it simpler: If 10 people use AI to make features and only 2 look for security in them, the 2 will get simply overwhelmed. It's only nature. Thats the reason we are entering a bad phase for security, it's not the quality of the AI tools, but hte priorities people seem to have with them. AGAIN: if you are so sure that your pack is secure, tell us its name so as we can audit it. Hiding behind anonymity so as only the open source projects take the bullet is not a proof of security.

The issue is more complex than you make it appear. If me, a bus driver turned AI coder, can identify various exploits using AI for six months now (it started in April for me), it's only logical to assume that seasoned senior engineers can do much better. The problem is I don't see the fixes. I have access to the three flagship open source packs (L2JServer, L2JMobius, aCis) that have recently released newer versions. None of them have any of the fixes, but has tons of unecessary tweaks on skill formulas, geodata and such. This looks like the developer teams don't know what priorities are or that they have no sense on the reality of the emulation / server world. They treat the projects as toys. And that would be fine, except they are charging people money for private versions supposedly having earlier fixes, which they don't have !. Which is why, answering to the 2nd quesiton, I am not sharing a list of exploits, nor am I contributing any fixes. I have no obligation to the developers of these semi-public packs. And besides, this forum here is called maxcheaters, not maxcoders, not maxcvedatabase. There's a section about sharing exploits, we are the bad guys here. Also do not assume that I have not approached people discretelly in the past to explain to them where their packs need attention. In the best cases, they didn't even understand why their packs are vulnerable, and dismissed fixes they later applied silently. At worst cases they became very rude about it confusing a discrete privatelly disclosed issue to them personally, is an attempt to insult them. Also I'm not irresponsiblity spreading exploits. I've only posted one adena dupe and gave an explanation to a leaked one that the project owner didn't patch for long and people found out. That doesn't mean I have any responsiblity to explain to everyone how to use every exploit. If you look carefully at conversations, you will notice that certain high profile open source developers, have difficulty grasping how an exploit works when you give them the fix / patch. That show's that they are probably not good enough, or experienced enough in that matter. Do you wanna tell us what pack you are using / developing so as we can check how valid my claims are ? Maybe I'm wrong and your specific pack which I don't know, is not vulnerable. That would be good to know there's at least a pack that's secure enough for us to use. I'd be glad to spend some tokens on it to do an audit.

And for these who can't write the exploit themselves when Claude Code denies to write it, they can switch to OpenCode and GLM 5.3 and it will do the dirty job without any objection. These AI tools will be the DDay for our sector the following months I tell you. The newer models are finding way more vulnerabilities the old ones couldn't and some of the ways they exploit the code is very creative. I can't believe that prominent developers of open source projects are "patching skill xml values to match retail formulas" while instead they should be focusing 100% on the shitstorm that is about to hit. It seems to me that the people who are curerently running the open source sector of L2J (aCis, L2JMobius and the smaller packs), have no clue of what running a real server means. Cause if they had any freaking idea, they would be working on security first. And there's a second i ssue too. Vibe coding with AI introduces the same amount of exploitable code as developers themselves did in the past. You have to guide the AI properly or make it pass your code with different context focus 2-3 times after you develop your feature in order for it to find the vulnerabilities it just created. And what makes it worse is that this accumulates if AI is not given good instructions on how to properly layer the code. After a couple of new files the code gets so spaghetti if not intentionally architectured, that a single line here, introduces 5 exploits in another place of the code. All in all: AI's are able to find exploits (and patch them) at a very rapid rate, but the way they are used, introduce many new ones at an even faster by inexperienced users. And since most people focus on "building things" than "fixing things", the code quality (and security) is expected to go DOWNWARDS the next months / years.

Ever since claude has gotten good, I have used it to make my files better. Over the last three months I have uncovered a STAGGERING amount of exploits using claude, simply by directing it to methods of exploitation and areas of the code I know from experience are not well developed. At first I thought it was only L2JMobius issues, but it turns out all known public and private packs are insecure in multiple ways. The L2J codebase from which all packs derive, is so incoherent with so many interweaving layers, a complete lack of proper layering, such that one simple line change that looks totally innocent, can lead to the surface of multiple exploitation vectors. The way things stand now, a player with some knowledge of how things work and a claude subscription can easily bypass client guards and basically ruin servers. It astonishes me that this has not yet happened as I can't be the only one that has a pair of eyes that have seen these things. The things will get much worse as time passes cause there's a huge amount of code being produced in most packs using AI agents. Code that is not properly checked and that poses big risk for anyone willing to adopt it as it introduces a lot of uncertainty to his project. At this point I'm at a loss for words. I personally cannot guarantee to the player base, that with any pack available, I can open a server and won't have a hacker a week later corrupt the whole econbomy of the server. Sad times ahead ...

Credits: Galagard Person responsible: Mobius Vulnerable: All L2JMobius versions public and private that support Evolving and Devolving Pets. What's needed: A pet that a Pet manager can devolve/evolve , for example a Great Snow Wolf Adena or a stackable item A server that won't restart for 24 hours. How to do the exploit: Take a Great Snow Wolf to the Pet Manager that has devolve abilities (e.g. Aden) Put the stackable items or adena you want to dupe inside the pet's inventory Open the Html of the Pet Manager, navigate to the Devolve Pet screen, DO NOT CLICK DEVOLVE YET Kill the pet (you can move outside if needed, door is very close). Get back to the manager with the HTML open (do not close the HTML). Click Devolve Pet: You will end up with a new pet (Great Wolf) alive and an old dead body of Great Snow Wolf. Open the inventory of the Great Wolf, it will have the adena and items you put in the old (dead) pet. Take them into your inventory. Wait 24 hours for the old pet corpse to decay. The moment it decays, it will give you the DUPED items back in your inventory. How to repeat in shorter time: You can re-evolve the Snow Wolf from NPC and repeat the same thing at once. You will end up with a second corpse. So 24 hours later + delay, you will get a 2nd dupe. You can keep repeating this forever and stack items with an initial delay of 24 hours (no need to wait 24 hours again). I have not confirmed this step ingame but theoritically with a crafted packet you can pull item from the corpse without waiting for 24 hours. This is a second exploit, the packet doesnt check if the pet is dead, it relies on clientside. Someone has to confirm, didnt try this one as I said. How was this issue caused: L2JServer developers They never checked for a pet that is out and putting a dead pet away does nothing. Mobius himself In commit 24e82859cab, 2021-05-28, "Unsummon previous existing pet, return null if template does not exist." public static synchronized PetInstance spawnPet(NpcTemplate template, PlayerInstance owner, ItemInstance control) { - if (World.getInstance().getPet(owner.getObjectId()) != null) + final PetInstance existingPet = World.getInstance().getPet(owner.getObjectId()); + if (existingPet != null) // owner has a pet listed in world { - return null; // owner has a pet listed in world + existingPet.unSummon(owner); } He tried to fix a null pet (dead) and lifted the only restriction that accidentally blocked the exploit in previous L2JServer versions making L2JMobius the ONLY pack vulnerable to this incumbating issue. Patch: <h1> I don't know how to write code to produce a patch, I'm a vibe coder </h1>

Oh no ! Don't block me, I'll appeal to the European Court of Human Rights !

Where did you learn that economics, same place you learned coding ? Can you even read a financial statement ? Let me educate you a bit: Anthropics operating revenue is positive. What users pay - what it costs to run (electricity gpu depreciation) is POSITIVE. What is subsidized is the cost of training new models, the RnD part which is huge. Which means that in order to compete in the AI race, they have to get investors money to cover huge research expenditures. In other words: For each dollar you PAY anthropic, they pocket about 40% as gross profit after you remove the costs of running the inference business. In IT companies, RnD because it's human spending mainly, by accounting, is obligated to put it in the income statement as expense. In ALL other companies, this is CAPEX, and goes into the cash flow statement so the net income looks positive. Do me a favor, if you ever get money on your hands, NEVER try to invest them yourself.

Wow ... Did they elect you debater of the century or something ?

If I recall how many collegues have told me that "next year" Anthropic will double the prices in 2024, 2025, 2026 ... Shortages can spike the prices, but as technology becomes better, frontier technology becomes comodity. The gap between open weight models and private frontier models is getting narrower month after month. Progress is here to stay. It's very rare for humanity to regress in technology. I'm not saying it can't happen, but it has happened 2-3 times in the history of our civilization. AI agentic coding is here to stay. There's no ride to enjoy, we are going through a shift in the way we produce software. That's all.

He is, he's a good engineer, has contributed tons to the L2J ecosystem, but sometimes he can be a complete asshole ...

Why won't we be able to afford them ? DeepSeek V 4.1 Flash 1017 even at quantized forms is on par with Opus 5. And it can run in enthusiast commercial hardware, doesnt need clusters of H200.

My good friend Galagard. I never question the quality of your project. Infact, from all those great Villains banned from your discord, I'm the only one that still claims that its the best open source L2 emulator available. I'm just astonished that you had to badmouth my navmesh when Mobius announced his cell engine in discord. What's the point ? Do you need to badmouth others in order to market your thing? I wasn't even there, I havent been in your discord for at least a month. But people from there still talk to me and they showed me what you were saying even though I thought after the last conversation we two had that we left the past behind. The problem that you all have as a team is that you take productive suggestions as insults. We share ideas that you have not thought, you get offended. We share security issues you have not fixed, you get offended. Isn't it high time you two graduated from the kindergarden ?

I see you guys bad mouth in your discord server "those that build navmesh gimmicks" obviously directed to me and my idea back then to incorporate 3dnavmesh in L2JMobius. Back then you managed to make 4 different claims in 1 day. That I didn't have it (I do), that I should commit it, that you have it in subscribers already (you don't) and finally that you don't need it. When you are finally done with your cell / pathnode engine you are building whatever it is, I challenge you to a public benchmarking duel. Your pathing engine, vs my 3dnavmesh, both running on L2JMobius. My bet is that my 3dnavmesh will obliderate in performance your attempt. And here's the bet. You win, I give you 250 euro, for free, nothing in return. I win, you give me access to subscribers version of L2JMobius. You take the bet or are you a chicken Mobius ?

Can't say I like this guy, but respect, he always delivers.

When you say bots allowed, it means we are allowed to use adrenaline ?

Since technical talk offends people, I believe I should return back to writting my Lineage 2 lore stories. Here's the next one: Once upon a time, there was a boy and a small adorable wolf. The boy really loved the wolf but as the wolf grow older and bigger, it became agressive and would bite the boy. One day the boy and the wolf decided to go to the city to buy potions. The road was long and hilly so the boy moved all his adena to the wolf bags to help his legs and reach the city easier. When they reached the city, the boy tried to take the adena out of the wolf's bags. But the wolf would not ! He bit the boy and said "You will not get this adena back, this is my adena". The boy got angry. He decided to go to the pet master and ask for help. "Pet master, pet master ! My wolf is big, bad and angry and it won't obey me. I want my adena back and it bites me. " The pet master looked at the big angry wolf, then looked at the boy and said. "I have a solution for your problem young one. I have magic. Dark magic. I can turn your big bad elder wolf into a younger puppy for free, all you have to do is spell the magic chants. Nothing more, no wolf modifying wands, just your say". The boy thought about it for a bit, and decided that he indeed wanted to turn things back. But when he was about to spell the magic words, guards arrived at the pet master. The city guard captain said "Is this the big bad angry wolf that bites people and doesn't give back his adena ? We will kill this wolf !" For a moment the boy hesitated but he said "This wolf is big bad and angry, but I love this wolf and I dont want it to die ! Please don't kill the big bad angry wolf." But the boy was not fast enough. The guards jumped the wolf and started slashing on him with their swords. The boy didn't know what to do, so in it its final moments right as the wolf was about to die, it spelled the magic words. "Pet master, make my wolf young and adorable again !" But he was not fast enough. The wolf got slashed and killed by the guards just one moment before the boy could finish his last word. But as the words came out of his mouth, with the wolf's dead body on the floor, a younger wolf manifested out of thin air. The magic was real. The guards got scared and run away. Now the boy was left with a dead old bad angry wolf and next to him an alive younger version. The boys joy was even bigger when it opened the new wolfs bags and his adena was finally there. He took the adena and went back to buy potions in the city. Twenty four hours later, the boy couldn't believe how his fortune would change ... (No AI was used to write this story)

My bug report was a proper submission. I shouldn't have shown the exploit, I will accept that. Let's end it here.

I edited my reply cause it was too rude. But you had already answered.

Let me think ... I come to your forum, I send you a fix for the exploit. I do not mention that its exploit nor I say how to reproduce it cause Mobius got mad the last time this happened. You personally reply and reject that it works. Probably you didnt understood it. But then again you personally have been an asshole to me for months in your shitty discord server (which is why i left). I reply back and hint you how it works without giving unnecessary details, you still dont understand. You leave it unpatched for days ... Then you come here mention me and challenge me to post a video of the exploit ... Asshole-ness is a mutually contracted disease. If you stop being one, I can stop being one.

Why would I need to prove the exploit ? Can't you figure it out from the code in the patch ? I thought you are a developer. Proving the exploit would help everyone reproduce it.