Jump to content

Recommended Posts

Posted

Security is done by modifying the server core and client Engine.dll. That itself makes it worthless to buy it, sorry.

 

If you want real protection you should implement a packet clouding and you are ready to go, also its lightweight, doesnt need client modifications(which are suck bad in so many ways), and you dont -beep- your core up instead you improve the code along with it.

 

You mind explaining your near lunatic approach to security without having a secured clientside change to the stan?dard algorhythms

 

Wtf is packet clouding?

 

 

 

Or was this just some attack on the creator for whatever reason?

Posted

You mind explaining your near lunatic approach to security without having a secured clientside change to the stan?dard algorhythms

 

Wtf is packet clouding?

 

 

 

Or was this just some attack on the creator for whatever reason?

 

Leave him mate, he is in his own world of L2J MXC Dev Team, )

Posted

Packet clouding aka packet obfuscation makes it harder(near impossible with current tools) to identify the packets. In other words it hides the meaning of the packet and because of the fact that its implemented along with the protocal version, everything that tries to connect to your server(doesnt matter if its client, bot or program that simulates the login process) get disconnected because in order to connect, your client that connects to the server needs to support obfuscation too.

 

In the simplest way it makes the packet traffic confusing to external clients that does not support obfuscation, which is everything except your lineage client.

Posted

Packet clouding aka packet obfuscation makes it harder(near impossible with current tools) to identify the packets. In other words it hides the meaning of the packet and because of the fact that its implemented along with the protocal version, everything that tries to connect to your server(doesnt matter if its client, bot ot program that simulates the login process) get disconnected because in order to connect, your client that connects to the server needs to support obfuscation too.

 

In the simplest way it makes the packet traffic confusing to external clients that does not support obfuscation, which is everything except your lineage client.

 

It's better to use an Updater, so you can change the protocal all the time.

Posted

It's better to use an Updater, so you can change the protocal all the time.

 

No its not because its easy to always get the new protocol of your client(you need to publish it in some way to let people connect so they just connect to a different protocol and cheating works again.

Posted

No its not because its easy to always get the new protocol of your client(you need to publish it in some way to let people connect so they just connect to a different protocol and cheating works again.

 

Obfuscation requires new way of calculting opcodes for packets, aka intervening in client aka a client extension.

 

 

Any change of blowfish or standard RSA keys in client\server - is easily bypasseble.

 

 

So first you say changing the encryption (Wether opcode first\second byte only) by engine hooks is crap.

And then you say the most logical thing to do is changing it - by fixing a few BYTEs in the keypacket?.

 

Any decent implementation of a sniffer\editor (for bot or otherwise) would sniff from a direct socket or ws32 connect and just snap up any key that is not contained within the client rendering any serverside only protection useless.

 

Are you just really...daft and full of ego from praise from idiots on MXC?

 

 

What the hell?

 

 

 

There's absolutely no point in attacking the OP (wether his protection is awesome or just shit) - short of you wanting to flex muscle.

Which also reveals the sadstate of MXC - and how no one has any knowledge to verify the information they're presented with.

Posted

Obfuscation requires new way of calculting opcodes for packets, aka intervening in client aka a client extension.

 

 

Any change of blowfish or standard RSA keys in client\server - is easily bypasseble.

 

 

So first you say changing the encryption (Wether opcode first\second byte only) by engine hooks is crap.

And then you say the most logical thing to do is changing it - but by using already defining keys in client.

 

Are you just really...daft and full of ego from praise from idiots on MXC?

 

 

What the hell?

 

 

 

There's absolutely no point in attacking the OP (wether his protection is awesome or just shit).

 

Okay i see you dont get it. Packet obfuscation is implemented in the client it requires no client modification. That has nothing to do with the gameserver - loginserver communication because its custom. I dont say change the encrypton god...i say that theres an unfinished packet that goes along with the protocol detection and it contains the packet obfuscation, thats the protection retail servers have(packet obfuscation was translated to java from a leeked off source) so your argument is pretty much useless.

Posted

Okay i see you dont get it. Packet obfuscation is implemented in the client it requires no client modification. That has nothing to do with the gameserver - loginserver communication because its custom. I dont say change the encrypton god...i say that theres an unfinished packet that goes along with the protocol detection and it contains the packet obfuscation, thats the protection retail servers have(packet obfuscation was translated to java from a leeked off source) so your argument is pretty much useless.

 

No it's not retard.

 

Because any key that is sent FROM the server for any type of algorhythm\encryption - can be snapped up without YOU on the serverside able to do ANYTIHNG about it.

 

Jesus christ - read some basic security strategies\system developemnt.

Posted

No it's not retard.

 

Because any key that is sent FROM the server for any type of algorhythm\encryption - can be snapped up without YOU on the serverside able to do ANYTIHNG about it.

 

Jesus christ - read some basic security strategies\system developemnt.

 

God you still dont get it...your stupidity amazed me really, but okay i'll give it a try again. Packet obfuscation is a feature that hides your protocol when you communicate with a server. When this happens only those clients can identify the protocol that supports obfuscation others cant. When this feature is in works, the communication looks like a bunch of random stuff all over the place, so tools that easily identify eg the protocol and packets sent cant do this anymore unless they write a whole new one.

Posted

God you still dont get it...your stupidity amazed me really, but okay i'll give it a try again. Packet obfuscation is a feature that hides your protocol when you communicate with a server. When this happens only those clients can identify the protocol that supports obfuscation others cant. When this feature is in works, the communication looks like a bunch of random stuff all over the place, so tools that easily identify eg the protocol and packets sent cant do this anymore unless they write a whole new one.

 

Please read some books and learn basic security.

 

If Server sends XYZ to Client - anyone on the clientside can snap that up and read it.

 

If server obfuscates XYZ to ABC - Client needs a way to decrypt ABC into XYZ.

 

 

If there's a algorhythm\function that does this - a sniffer without hooking needs to know the way ABC turns into XYZ.

There could be several keys of variable length or one - but if that key is sent by server the sniffer can know the time during the initial connections where the server sends the key to turn ABC into XYZ.

 

Sniff it - and replicate the algorhythm within the sniffer and boom protection is broken.

This is true of any Obfuscation\Encryption\Algorhythm.

 

This is weak - because there will be a standard established way to calculate ABC to XYZ in the client that NEVER CHANGES.

And even if the key is random each time the server sends it to client - it would not matter because it would sniff the key each time.

 

 

There is no way 100% protect - but if you change keys and the way to calculate ABC to XYZ and protect it enough in a DLL so it requires abnormally large time to fully learn the new calculation method - you'll keep out 99,9%.

 

 

Simple logic, wether L2 or Hello Kitty Adventure Island.

 

 

Spewing random shit like "PACKET CLOUDING MAYNZ" and "Obfuscation" that the newer gracia clients support (and do not support as well) is pointless - when you seem to fail to grasp the basic mathematical logic behind systems.

 

 

By not touching client your relegated to NCSofts clientside functions of decrypting any data sent Server<>Client.

 

Jesus christ - it's sad that your supposed to be a super high ranking mxc dev and you don't understand basic premises of communication -_-

 

Posted

Also FYI:

 

There's always been encryption since c3 was it? - adding an extra obfuscation layer does nothing but complicate the data process and add more overhead in calculating the correct packet Opcode.

 

Learn the normal encryption + the packet opcode obfuscation and you can still easily bypass anything.

Hence the need for something "custom" even if it's Opcode^2 - and then make sure it's hard as hell to figure out it's just Opcode^2.

Posted

Also FYI:

 

There's always been encryption since c3 was it? - adding an extra obfuscation layer does nothing but complicate the data process and add more overhead and in calculating the correct packet Opcode.

 

Learn the normal encryption + the packet opcode obfuscation and you can still easily bypass anything.

Hence the need for something "custom" even if it's Opcode^2 - and then make sure it's hard as hell to figure out it's just Opcode^2.

 

Its not custom you freekin fcktard god...ITS A PACKET FROM THE CLIENT. Anyway done with the arguing have better things to do than listening your pretty much senseless arguments. Nothing shows that better than the fact that 1st you ask what the hell is packet obfuscation than you suddenly become the professor of it, good guy google helped i guess.

Posted

Its not custom you freekin fcktard god...ITS A PACKET FROM THE CLIENT. Anyway done with the arguing have better things to do than listening your pretty much senseless arguments. Nothing shows that better than the fact that 1st you ask what the hell is packet obfuscation than you suddenly become the professor of it, good guy google helped i guess.

 

I didn't say it was custom.

 

I said the need for something custom - even if simple beats the hell out of standardized process that's the same for everyone else.

 

 

And yes you are retarded - because you do not read my posts nor answer them.

You just act like a bigshot and call arguments senseless without saying specificly why.

 

I geuss because they're logical and your used to garbled MXC idiots.

Where yelling and throwing "OMFG MXC SUPAH DEV" tag helps an argument.

 

You can't magicly invent a different way the entire subset of computers communicate and pretend it's awesome.

 

 

Posted

I think they left the subject in my sale ...

I would like to know if someone broke my security system because they said so many things ...

 

 

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



  • Posts

    • Since technical talk offends people, I believe I should return back to writting my Lineage 2 lore stories. Here's the next one:   Once upon a time, there was a boy and a small adorable wolf.    The boy really loved the wolf but as the wolf grow older and bigger, it became agressive and would bite the boy. One day the boy and the wolf decided to go to the city to buy potions. The road was long and hilly so the boy moved all his adena to the wolf bags to help his legs and reach the city easier.   When they reached the city, the boy tried to take the adena out of the wolf's bags. But the wolf would not ! He bit the boy and said "You will not get this adena back, this is my adena". The boy got angry. He decided to go to the pet master and ask for help.    "Pet master, pet master ! My wolf is big, bad and angry and it won't obey me. I want my adena back and it bites me. "   The pet master looked at the big angry wolf, then looked at the boy and said. "I have a solution for your problem young one. I have magic. Dark magic. I can turn your big bad elder wolf into a younger puppy for free, all you have to do is spell the magic chants. Nothing more, no wolf modifying wands, just your say".   The boy thought about it for a bit, and decided that he indeed wanted to turn things back. But when he was about to spell the magic words, guards arrived at the pet master.    The city guard captain said "Is this the big bad angry wolf that bites people and doesn't give back his adena ? We will kill this wolf !"    For a moment the boy hesitated but he said "This wolf is big bad and angry, but I love this wolf and I dont want it to die ! Please don't kill the big bad angry wolf." But the boy was not fast enough. The guards jumped the wolf and started slashing on him with their swords. The boy didn't know what to do, so in it its final moments right as the wolf was about to die, it spelled the magic words. "Pet master, make my wolf young and adorable again !"   But he was not fast enough. The wolf got slashed and killed by the guards just one moment before the boy could finish his last word.    But as the words came out of his mouth, with the wolf's dead body on the floor, a younger wolf manifested out of thin air. The magic was real. The guards got scared and run away. Now the boy was left with a dead old bad angry wolf and next to him an alive younger version.    The boys joy was even bigger when it opened the new wolfs bags and his adena was finally there. He took the adena and went back to buy potions in the city.   Twenty four hours later, the boy couldn't believe how his fortune would change ...   (No AI was used to write this story)
    • This is like 2017 MaxCheaters. i love it.
    • NEW SEASON GRAND OPENING FROM - 30 OCTOBER 2026, FRIDAY, 20:00 +2 GMT !
    • My bug report was a proper submission. I shouldn't have shown the exploit, I will accept that. Let's end it here. 
    • To Finish this, because it's need a explanation   1. “I come to your forum” — It's the L2JMobius forum, not mine. I'm a contributor, not the owner or the maintainer responsible for deciding which fixes get committed.   2. “Which is why I left” — That's not an accurate account of what happened. You may have left voluntarily once, but you were also banned from the Discord server three times after repeatedly returning and causing the same disruptions. Those are not the same thing.   3. “You personally reply and reject that it works” — I asked how a negative withdrawal could be performed and later requested a demonstration of the claimed exploit. At no point did I reject the patch or claim the vulnerability was impossible. Asking for evidence is not the same as rejecting someone's work.   4. “You leave it unpatched for days” — I don't make that decision. Whether and when a patch gets committed is entirely up to the project maintainer, not me.   5. “You challenge me to post a video” — Yes, I asked you to demonstrate the exploit. You interpreted that as a rejection of your work, which it wasn't. Requesting proof of a claimed exploit is a perfectly reasonable part of technical discussion.   6. “Asshole-ness is a mutually contracted disease” — You're responsible for your own behavior, just as I'm responsible for mine. Disagreeing with you or questioning your claims doesn't justify personal insults. If you believe I've treated you unfairly, address what I actually said rather than making my behavior an excuse for yours.   And one question remains unanswered: why did you publicly disclose the exploitationmethod before the fix was released, after previously saying you wanted to avoid harming the project?   The vulnerability was real, the fix was accepted, and the commit was published. I have no problem acknowledging any of that.   My disagreement has never been about whether the bug deserved to be fixed. It's about how you've handled the discussion and repeatedly misrepresented my role in it.     I have nothing against you personally. My issue is with the way you conduct yourself in these discussions.   And no, you're not obligated to prove anything to me. However, when you make a technical claim, the burden of proof is on you. You cannot reasonably expect others to accept your claims without sufficient evidence.   Questioning a claim is not the same as rejecting it, nor is it a personal attack.   This isn’t about fanaticism; it’s about pushing back against the completely senseless attacks constantly leveled at the project as a whole.   It’s always the same thing: they badmouth it, claiming the project is worthless—yet the very same people criticizing it are the first in line to download a leaked version.   Enough is enough. This discussion has dragged on far too long over something that ought to be straightforward; if you’re going to submit a bug report, you should at least do it properly.
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..