Request How to dupe adena in l2Jmobius ?

[Maurizio]

I found this online https://l2jmobius.org/forum/index.php?topic=16086.0 (https://pastebin.com/hGY3f95S)

 

I'm not very good with codes but how to know this works in server I play ? Do I need program ? I wanna do for science purposes no cheat. Sorry for bad english.

[rexen]

Crafted packet mean you need to modify the packet befor is sended to server 

[Maurizio]

I have adrenaline subscription, can I do it ? I need to make bypass to server as the API says ? Adrenaline works in server I play and is l2Jmobius server I asked.

Edited Monday at 09:51 PM by Maurizio

[eMommy]

You can manually send the bypass (if this is a bypass not a packet function) using:
 

 Engine.BypassToServer(Bypass);

Click the red circle to record game actions (it should capture bypasses) and then you can manipulate it as such with a simple script

begin
 Engine.BypassToServer(Bypass);
end.

 

[Galagard]

9 hours ago, Maurizio said:

I found this online https://l2jmobius.org/forum/index.php?topic=16086.0 (https://pastebin.com/hGY3f95S)

 

I'm not very good with codes but how to know this works in server I play ? Do I need program ? I wanna do for science purposes no cheat. Sorry for bad english.

Already fixed in subscriber version, but this bug report is classified as "Invalid" because since the author did not explain the method in detail, the validation flaw does indeed exist—but that alone does not prove it is possible to duplicate adena or any other item by exploiting said flaw.

It looks like yet another AI hallucinating a vulnerability, then deducing that it could be used to exploit a different vulnerability. No have proofs in video or a detailed way to reproduce the potential failure

Go find something else to do, Baldurian; you don’t even know how to exploit the flaw you reported yourself.

[aguy]

To use this exploit you have to:

 

1) Have access to the castle vault, aka you have to own a castle.

2) Send through Adrenaline Engine.BypassToServer(Bypass) as emommy said

3) In the crafted packet you will put a negative amount eg -100000000 What this does is it multiplies it by -1 so it becomes positive.

4) You won't see anything in your inventory, but if you open the castle vault through the Chamberlain you will see that the warehouse now has 10000000 adena. The negative became positive.

5) Withdraw the adena normally and you now have all the adena you need.

 

I wouldn't bother explaining how to do it, but this idiot (Galagard) wanted to challenge me. And from what I can see, they haven't patched the exploit even if I reported it to them a week ago so it's obvious that people will start sharing it around.

 

Maybe I should start positing here instead of the official channels.

 

All public versions of L2JMobius for all chronicles are vulnerable and not patched yet.

 

And thanks to this idiot (Galagard), everyone now knows.

 

Baldurian.

EDIT: 
 

Ok I just got informed that Mobius decided to accept the fix in the public repo.

 

So I will now post a proof of the exploit as Galagard requested.

Normally I don't do so, but my good friend Galagard who has his nose so far stuck up his asshole, insulted me, and challenged me to show proof:
 

 

And to be fair to everyone, this is not an L2JMobius issue as the thread claims. It's L2JServer leftover, so if you have L2JServer derivative packs, you should patch too. 

Edited yesterday at 09:39 AM by aguy

[Galagard]

First of all, I never challenged you at any point.

 

Second, congratulations—this is what you should have done from the start: shown how it worked, how to exploit it, etc.

Now, let’s look at the facts:

 

The flaw requires the person to be the OWNER of the castle.

 

It requires the use of third-party programs or a modified client—and most private servers don’t even allow the use of modified clients, thanks to their anti-cheat systems.

 

Are you honestly certain that a castle owner on a private server would risk losing their account just to pull off this exploit? They’d have to be a complete idiot.

 

You’ve spent months going on about how you discovered a bug that has ZERO impact on the actual gameplay—congratulations.

 

I’m not saying that flaws are bad or that they shouldn’t be fixed—in fact, the flaw *was* fixed.

 

What I’m saying is that you’ve been harping on the same point for months, even though the issue had already been resolved in the closed branch.

 

It’s the prerogative of those who maintain the code to fix things however they see fit, don’t you think?

 

And learn this: when you report a bug, you MUST:

1- Report the bug (obviously)
2- Explain in detail how the bug occurs
3- Prove that the bug actually happens

 

And instead of contributing to the project through the proper, public channels, you chose to turn this into a whole circus—I’d just like to understand why...

 

It’s a good thing everyone in this thread will get to see who the "asshole" is.

Edited yesterday at 02:36 PM by Galagard

[aguy]

Why would I need to prove the exploit ? Can't you figure it out from the code in the patch ? I thought you are a developer. Proving the exploit would help everyone reproduce it. 

Edited yesterday at 03:40 PM by aguy

[Galagard]

Quote

Posted 9 minutes ago (edited)

Why the fuck would you need me to explain how the exploit works ? You should be easily able to figure it out from the patch I sent you. The patch is for developers, we are not trying to explain to players how to dupe adena. At this point I'm starting to question if you're even a developer or you are pretending to be one. Apparently you couldn't figure out from the patch how the exploit works and needed for me to send you a video ...

 

But since you insist:

Would you like me to show you adena dupes in the code that require no client modificaitons that are not fixed in the private version ?

I'll make you look even more fool than you already look.

Edited 5 minutes ago by aguy

You initially claimed you didn't want to disclose the exploit because it could harm the project.

 

So why did you later decide to publish the exploitation method publicly, before the fix was released?

 

What changed?
 

My issue isn't with the bug itself, but rather with how it was discovered.

 

I shouldn't just assume that the bug actually works; if it was an AI that discovered it, then that is precisely the context in which proof becomes mandatory.

 

And another thing: why don’t you start by opening threads detailing all the bugs you claim to have discovered, instead of broadcasting vulnerabilities on an open forum?

 

Why do you expect recognition beforehand? That’s not the logical order of things—you provide actual help first, and only then do you earn recognition. That’s how things work in the real world.

Edited yesterday at 03:49 PM by Galagard

[aguy]

Let me think ...

 

I come to your forum, I send you a fix for the exploit.

I do not mention that its exploit nor I say how to reproduce it cause Mobius got mad the last time this happened.

You personally reply and reject that it works. Probably you didnt understood it.  But then again you personally have been an asshole to me for months in your shitty discord server (which is why i left).

I reply back and hint you how it works without giving unnecessary details, you still dont understand.

You leave it unpatched for days ...

Then you come here mention me and challenge me to post a video of the exploit ...

 

Asshole-ness is a mutually contracted disease. If you stop being one, I can stop being one. 

 

 

Edited yesterday at 03:52 PM by aguy

[Galagard]

As if I’m the one hiding behind alt accounts just to get attention.

 

Anyway, congratulations on the commit—that’s what you wanted, right?

 

P.S. Why did you edit your last reply? It’s pointless; it’s already quoted right there, in case you hadn’t noticed.

 

EOF

[aguy]

I edited my reply cause it was too rude. But you had already answered.

[eMommy]

Mobius users develop a cult-like fanaticism towards the Hellenic overlord like how they do with pedric this should be something that is studied since it is truly so weird

[Galagard]

To Finish this, because it's need a explanation
 

1. “I come to your forum” — It's the L2JMobius forum, not mine. I'm a contributor, not the owner or the maintainer responsible for deciding which fixes get committed.

 

2. “Which is why I left” — That's not an accurate account of what happened. You may have left voluntarily once, but you were also banned from the Discord server three times after repeatedly returning and causing the same disruptions. Those are not the same thing.

 

3. “You personally reply and reject that it works” — I asked how a negative withdrawal could be performed and later requested a demonstration of the claimed exploit. At no point did I reject the patch or claim the vulnerability was impossible. Asking for evidence is not the same as rejecting someone's work.

 

4. “You leave it unpatched for days” — I don't make that decision. Whether and when a patch gets committed is entirely up to the project maintainer, not me.

 

5. “You challenge me to post a video” — Yes, I asked you to demonstrate the exploit. You interpreted that as a rejection of your work, which it wasn't. Requesting proof of a claimed exploit is a perfectly reasonable part of technical discussion.

 

6. “Asshole-ness is a mutually contracted disease” — You're responsible for your own behavior, just as I'm responsible for mine. Disagreeing with you or questioning your claims doesn't justify personal insults. If you believe I've treated you unfairly, address what I actually said rather than making my behavior an excuse for yours.

 

And one question remains unanswered: why did you publicly disclose the exploitationmethod before the fix was released, after previously saying you wanted to avoid harming the project?

 

The vulnerability was real, the fix was accepted, and the commit was published. I have no problem acknowledging any of that.

 

My disagreement has never been about whether the bug deserved to be fixed. It's about how you've handled the discussion and repeatedly misrepresented my role in it.

 

 

I have nothing against you personally. My issue is with the way you conduct yourself in these discussions.

 

And no, you're not obligated to prove anything to me. However, when you make a technical claim, the burden of proof is on you. You cannot reasonably expect others to accept your claims without sufficient evidence.

 

Questioning a claim is not the same as rejecting it, nor is it a personal attack.

1 minute ago, eMommy said:

Mobius users develop a cult-like fanaticism towards the Hellenic overlord like how they do with pedric this should be something that is studied since it is truly so weird

 

This isn’t about fanaticism; it’s about pushing back against the completely senseless attacks constantly leveled at the project as a whole.

 

It’s always the same thing: they badmouth it, claiming the project is worthless—yet the very same people criticizing it are the first in line to download a leaked version.

 

Enough is enough. This discussion has dragged on far too long over something that ought to be straightforward; if you’re going to submit a bug report, you should at least do it properly.

[aguy]

My bug report was a proper submission. I shouldn't have shown the exploit, I will accept that. Let's end it here.