Page Index Toggle Pages: 1 [2] 3  Send TopicPrint
Hot Topic (More than 35 Replies) You people need to go read this (Read 18522 times)
Aeolwind
HERALD OF HATE
*
Offline


DDO: More broken than
peanut brittle

Posts: 2074
Location: Sarlona
Joined: Apr 13th, 2011
Gender: Male
Re: You people need to go read this
Reply #25 - Jul 24th, 2012 at 12:38pm
Print Post  
I can't help see this as the oft referenced rabbit hole though.  DDO has been fairly bereft of serious client attacks that I've been able to find.  And considering the source code makes swiss cheese envious, the security is probably bad.
  
Back to top
 
IP Logged
 
Schmoe
Epic Poster
*****
Offline


One world, one soul

Posts: 4219
Location: A chair
Joined: Jun 9th, 2010
Re: You people need to go read this
Reply #26 - Jul 24th, 2012 at 1:55pm
Print Post  
Bookmarked for later analysis.
  

"As my windshield melts, and my tears evaporate,
Leaving only charcoal to defend -
Finally I understand the feelings of the few,
Ashes and diamonds, foe and friend, we were all equal in the end."

-Waters
Back to top
 
IP Logged
 
Ckorik
Dragon Raider
***
Offline


N00b

Posts: 223
Joined: Jul 24th, 2012
Re: You people need to go read this
Reply #27 - Jul 24th, 2012 at 2:00pm
Print Post  
Reading the memory of the client isn't the same as manipulating it - this is all information the client *has* to have - the trick is just hijacking the messages being sent in your memory.

Injecting new values into the client (which is how you get things like speedhacking and wallhacking) is the easiest form of detection.

Typically the server has the same values for player location/health etc. and either doesn't outright accept changes from the client (safest method) or has sanity checks to make sure that values don't get weird.

All of that is why I laugh when people like Shade harp about the twitch 'skillz' and such - because your client typically lags behind what the server is actually doing by a decent amount.  That's why paralyzed mobs still move and you get dmg/healing that rolls on after a fight is over.

All of that isn't to say that DDO would detect that kind of thing - just attaching to the exe can be detected - that's how WoW catches botters (and by necessity they've gotten very good at that kind of thing) because they use a program they call the 'warden' to sandbox the actual client.

This type of memory reading is exactly how you break the network stream encryption though - by default the encryption key *has* to be kept in the client in order to process the packets - and if you know where to look you can break it out - it's how ShowEQ was able to work once Sony started to encrypt the network stream.

If you wanted to be sure this was harder to track - you would build in a randomizer into the process name on startup so that the program wouldn't ever report the same 'exe' in your tasklist when it's running - which makes it harder to trivially notice.
  

Back to top
 
IP Logged
 
Carpone
Puppy Farmer
****
Offline


I Love Drama!

Posts: 1695
Joined: Jul 2nd, 2011
Gender: Male
Re: You people need to go read this
Reply #28 - Aug 5th, 2012 at 10:00pm
Print Post  
...or Turbine could just capture combat logs to a text file like every other fucking MMO and let the players analyze it.  This is not hard.

Also: The chances of Turbine catching you running this code is close to 0.  Considering how many people ran macro programs for chestapalooza and were not banned....yeah.
« Last Edit: Aug 5th, 2012 at 10:01pm by Carpone »  
Back to top
 
IP Logged
 
Epoch
Alaskan Ice Hole
*
Offline


Epochalypse

Posts: 10377
Location: Frozen Tundra
Joined: Aug 29th, 2010
Gender: Male
Re: You people need to go read this
Reply #29 - Aug 5th, 2012 at 10:28pm
Print Post  
Carpone wrote on Aug 5th, 2012 at 10:00pm:
...or Turbine could just capture combat logs to a text file like every other fucking MMO and let the players analyze it.  This is not hard.

Also: The chances of Turbine catching you running this code is close to 0.  Considering how many people ran macro programs for chestapalooza and were not banned....yeah.



Those horrible despicable people!  I hope they never get what is coming to them!

Umm...
  

OnePercenter wrote on May 15th, 2014 at 9:41am:
I just read that the cat followed up by visiting the dog house later that night, dropping some Willie Pete in on the sleeping dog.  #epochsfamiliarFTW

Sim-Sala-Bim wrote on Jan 27th, 2014 at 2:09am:
It seems like Epoch never loses his popularity.
Even against donuts.
Back to top
 
IP Logged
 
Aeolwind
HERALD OF HATE
*
Offline


DDO: More broken than
peanut brittle

Posts: 2074
Location: Sarlona
Joined: Apr 13th, 2011
Gender: Male
Re: You people need to go read this
Reply #30 - Aug 6th, 2012 at 10:34am
Print Post  
Carpone wrote on Aug 5th, 2012 at 10:00pm:
...or Turbine could just capture combat logs to a text file like every other fucking MMO and let the players analyze it.  This is not hard.

I had a 2 gig text file from EQ lol, took me forever to find something to get it open and get it into HTML.  I miss those  Embarrassed
  
Back to top
 
IP Logged
 
Vexation
Waterworks Kobold
**
Offline


Blah, Blah, Blah...

Posts: 173
Joined: Jul 11th, 2012
Re: You people need to go read this
Reply #31 - Aug 6th, 2012 at 10:43am
Print Post  
Combat logs would rock.

Something tells me they probably would screw it up.  Just a hunch.
  
Back to top
 
IP Logged
 
Huginn
Korthos Resident
*
Offline


Oachkatzlschwoaf

Posts: 31
Joined: Apr 23rd, 2012
Re: You people need to go read this
Reply #32 - Aug 7th, 2012 at 2:11am
Print Post  
Olrad wrote on Jul 24th, 2012 at 9:25am:
Somebody get the guy who wrote it onto the Vault!


Done.

Smrti wrote on Jul 23rd, 2012 at 10:04pm:
I have emailed and tweeted Jerry with this link. I'll let you know if I get a response.


Aye, would be interesting to see if you get a response at all, and if it is more helpful than the responses I got from him.

bob the builder wrote on Jul 24th, 2012 at 9:08am:
The answer he's going to get is:
"The lawyers said no"

They are going to see his blog and see the term "hack" and not read anything else about it.  It's not worth their time and trouble to attempt to determine if it "safe" or not.


That is highly likely. Yet an "illegal" combat log parser just complicates things for everybody: Turbine, the developer(s) and the end users.

bob the builder wrote on Jul 24th, 2012 at 9:08am:
Now, he could score a job at Turbine out of it.


Move to the US? Hell no. Work for Turbine, quit my already awesome job? Hell no. I prefer to stay in the land of the corru^H^H^H^H^H social benefits and freedom.

Ckorik wrote on Jul 24th, 2012 at 2:00pm:
Reading the memory of the client isn't the same as manipulating it - this is all information the client *has* to have - the trick is just hijacking the messages being sent in your memory.


Aye, the application was meant to read information from DDO, not manipulate it. Breaking the network encryption of DDO is tricky: Once you go there you can never, ever hope to get support from Turbine. But support from Turbine (or at least a stance of indifference) is what would be most beneficial for this application. As everyone could use it and develop on it without fear of facing consequences. That is why I picked the least invasive method and went to Turbine with it.
  
Back to top
 
IP Logged
 
Flav
Vault Frog
*
Offline


One Frog to Rule them
All!

Posts: 9961
Location: Land of the Frogs
Joined: Aug 29th, 2010
Gender: Male
Re: You people need to go read this
Reply #33 - Aug 7th, 2012 at 3:15am
Print Post  
Aeolwind wrote on Jul 24th, 2012 at 11:36am:
From the way he was talking I don't think they are encrypted well.


HTTP, HTTPS and UDP IIRC.

Only the HTTPS is ( for what it's worth ) encrypted... Well to be honest, as I was troubleshooting what I thought was a connection issue ( it was the now (in)famous DNS Fucking problem ), I didn't loot at the packet content, but just at how they were sequenced.

UDP appears once you select a character.
  

Yes my avatar is an Hermine eating a Greenland Lemming for brunch.
Back to top
 
IP Logged
 
Huginn
Korthos Resident
*
Offline


Oachkatzlschwoaf

Posts: 31
Joined: Apr 23rd, 2012
Re: You people need to go read this
Reply #34 - Aug 7th, 2012 at 4:00am
Print Post  
Flav wrote on Aug 7th, 2012 at 3:15am:
HTTP, HTTPS and UDP IIRC.

Only the HTTPS is ( for what it's worth ) encrypted... Well to be honest, as I was troubleshooting what I thought was a connection issue ( it was the now (in)famous DNS Fucking problem ), I didn't loot at the packet content, but just at how they were sequenced.

UDP appears once you select a character.


Since the EULA only disallows deciphering the network stream I can tell you the following: Game related packages appear to be encrypted || compressed. And chat related messages are sent in plain text. That's right, your chat messages are sent in plain text. So do not send any critical information over the DDO chat.
  
Back to top
 
IP Logged
 
Hordo
High Rabbi
****
Offline


Le Douchebag

Posts: 2405
Location: Cordova, Tennessee
Joined: Jun 30th, 2009
Gender: Male
Re: You people need to go read this
Reply #35 - Aug 7th, 2012 at 7:55am
Print Post  
Huginn wrote on Aug 7th, 2012 at 4:00am:
Since the EULA only disallows deciphering the network stream I can tell you the following: Game related packages appear to be encrypted || compressed. And chat related messages are sent in plain text. That's right, your chat messages are sent in plain text. So do not send any critical information over the DDO chat.



WHAT??
Plain text???
Imagine that!
I'm so glad I didn't send that /tell to Gawna telling her my password was stainersnuts!  Wink
  

I am the Rabbi, goo goo g'Jew!
Who doesn't <3 Gornn?
GORNN II 4:3:17 - For Gornn sent not Hordo into the world to save the party; but that the party through him might be wiped.
[QUOTE=404error;4155294]Hordo I don't want to steal you from these forums because your almost an icon here. ;p [/quote]
Back to top
IP Logged
 
Huginn
Korthos Resident
*
Offline


Oachkatzlschwoaf

Posts: 31
Joined: Apr 23rd, 2012
Re: You people need to go read this
Reply #36 - Aug 12th, 2012 at 12:52pm
Print Post  
A second beta release is up, which you so should not download, or start!

https://github.com/downloads/n0la/dclog/dclog-0.1-beta2.zip
« Last Edit: Aug 12th, 2012 at 12:52pm by Huginn »  
Back to top
 
IP Logged
 
twat
Korthos Resident
*
Offline


I Love Drama!

Posts: 18
Joined: Oct 30th, 2010
Re: You people need to go read this
Reply #37 - Aug 21st, 2012 at 5:05pm
Print Post  
I guess someone put this to good use




http://forums.ddo.com/showthread.php?t=389632

[QUOTE=xxx13;4655148]== The Obvious ==

When you attempt to strike your opponent, an attack roll is made. A natural 1 on an attack roll is always a miss.

When you roll a fair 20-sided die (D20), each value is equally likely. Probability of rolling a 1 is 5%.

== The Unknown ==

When you attack with a falchion, the game uses a different die than when you attack with a dagger.
The "falchion die" is heavily loaded.
Probability of rolling a 1 is > 8%.

(Most likely this is a more general case: one handed vs two handed weapons.)

== The proof ==

Let's attack something many times. Many many times. Like: 10_000 times.

First with a dagger:


Then with a falchion:


== A bit of statistics ==

The chart below might be helpful when deciding how many rolls we need when testing dice.
After each 100 rolls I computed a test of goodness of fit (using Pearson's chi-squared test).



On this chart we have 3 hypotheses:
* yellow - "dagger D20" is fair
* blue - "falchion D20" is fair
* red - "falchion D20" is significantly unfair: 1 rolls 8% times, any other number 4.84%

Values under 0.05 are statistically significant "proof" that given hypothesis is not true.

As you can see the only hypothesis we can reject is the blue one. For example:
* after 5000 rolls p = 0.000000002
* after 6000 rolls p = 0.0000000000047 [/quote]

  
Back to top
 
IP Logged
 
stainer
Arkat's Bitch
*
Offline


Gawna's big sexy crony!

Posts: 12345
Location: gawna's nuts
Joined: Jan 28th, 2010
Gender: Male
Re: You people need to go read this
Reply #38 - Aug 21st, 2012 at 5:19pm
Print Post  
Hahaha. Busted.
  

Nilazgrc: For all those familiar with loreseekers/sentinels.... Dont run with Stainer.... Guy is a tool. Black list his toons.
kmack can drive the tractor.
The Vault donates to charity.
JDollar wrote on Apr 25th, 2013 at 4:47pm:
Stainer likes tractors
Back to top
 
IP Logged
 
Maxwell Edison
Bailiff
*
Offline


HADOUKEN!

Posts: 3142
Location: Bologna
Joined: Jul 13th, 2011
Re: You people need to go read this
Reply #39 - Aug 21st, 2012 at 5:21pm
Print Post  
Quote:
== A bit of statistics ==

The chart below might be helpful when deciding how many rolls we need when testing dice.
After each 100 rolls I computed a test of goodness of fit (using Pearson's chi-squared test).

...

On this chart we have 3 hypotheses:
* yellow - "dagger D20" is fair
* blue - "falchion D20" is fair
* red - "falchion D20" is significantly unfair: 1 rolls 8% times, any other number 4.84%

Values under 0.05 are statistically significant "proof" that given hypothesis is not true.

As you can see the only hypothesis we can reject is the blue one. For example:
* after 5000 rolls p = 0.000000002
* after 6000 rolls p = 0.0000000000047


Back to top      
[/quote]

I don't understand statistics well at all.  what the fuck does this part mean.
  

                                                                      
Back to top
 
IP Logged
 
Xenostrata
Ex Member


Re: You people need to go read this
Reply #40 - Aug 21st, 2012 at 5:29pm
Print Post  
Maxwell Edison wrote on Aug 21st, 2012 at 5:21pm:
I don't understand statistics well at all.  what the fuck does this part mean.


Unless I'm mistaken, it's the odds (y) of an event being true after (x) tests.

Any line that dips below the .05 mark can be assumed to be false, because there is a less than 5% chance that that hypothesis happened just by the luck of the dice. The yellow line (daggers are fair) and the red line (falchions are unfair) are safe, but the blue line (falchions are fair) quickly dips below .05 after some testing, to the point that the odds of the dice simply rolling lots of 1s (fairly) after 5000 tests is .0000002%.
« Last Edit: Aug 21st, 2012 at 5:29pm by »  
Back to top
 
IP Logged
 
Bahgoon
Stormreaver Piker
*
Offline


Get off my lawn!

Posts: 666
Joined: Jan 24th, 2011
Re: You people need to go read this
Reply #41 - Aug 21st, 2012 at 5:33pm
Print Post  
Maxwell Edison wrote on Aug 21st, 2012 at 5:21pm:
I don't understand statistics well at all.  what the fuck does this part mean.

Null hypothesis - some hypothesis that can be proven true or false. Here he gives three.

p value -  Assuming that the null hypothesis is true, the probability of obtaining a test statistic at least as extreme as the one that was actually observed. If the p-value is less than a significance value (.05 in this case), the null hypothesis is rejected (false).

What (s)he is saying here is that the hypothesis, "the falchion D20 is fair", is rejected or false.

Note - the terms true and false are used here in a guarded sense   Tongue
« Last Edit: Aug 21st, 2012 at 5:34pm by Bahgoon »  

The various modes of worship which prevailed in the Roman world were all considered by the people as equally true; by the philosopher as equally false; and by the magistrate as equally useful.   - Edward Gibbon
Back to top
 
IP Logged
 
Maxwell Edison
Bailiff
*
Offline


HADOUKEN!

Posts: 3142
Location: Bologna
Joined: Jul 13th, 2011
Re: You people need to go read this
Reply #42 - Aug 21st, 2012 at 5:34pm
Print Post  
Then I'm superglad the important part of the graph (the .05 mark) wasn't demarcated at all because a bunch of colorful squiggles without context makes it look a lot more sciencey.
  

                                                                      
Back to top
 
IP Logged
 
Elegorne
DQ Assaulter
*****
Offline



Posts: 433
Location: Georgia
Joined: May 4th, 2011
Gender: Male
Re: You people need to go read this
Reply #43 - Aug 21st, 2012 at 5:34pm
Print Post  
Maxwell Edison wrote on Aug 21st, 2012 at 5:21pm:
don't understand statistics well at all.  what the fuck does this part mean.


Quote:
Unless I'm mistaken, it's the odds (y) of an event being true after (x) tests.

Any line that dips below the .05 mark can be assumed to be false, because there is a less than 5% chance that that hypothesis happened just by the luck of the dice. The yellow line (daggers are fair) and the red line (falchions are unfair) are safe, but the blue line (falchions are fair) quickly dips below .05 after some testing, to the point that the odds of the dice simply rolling lots of 1s (fairly) after 5000 tests is .0000002%.



Hmmm...and to think I was gonna go with "Banana"
  

Elegorne,Wizegorne,Healegorne and some other gimp toons on Thelanis
Back to top
 
IP Logged
 
ertay
Korthos Resident
*
Offline


I Love Drama!

Posts: 26
Joined: Aug 5th, 2012
Re: You people need to go read this
Reply #44 - Aug 21st, 2012 at 9:32pm
Print Post  
Bahgoon wrote on Aug 21st, 2012 at 5:33pm:
p value -  Assuming that the null hypothesis is true, the probability of obtaining a test statistic at least as extreme as the one that was actually observed. If the p-value is less than a significance value (.05 in this case), the null hypothesis is rejected (false).



This is correct. Whats also noteworthy (although implied here already) is that p is in no way connected to the actual size of the effect; it merely signifies how certain you can be that there is an effect (simplified explanation), no matter how small or big the effect in question might be.
  
Back to top
 
IP Logged
 
stainer
Arkat's Bitch
*
Offline


Gawna's big sexy crony!

Posts: 12345
Location: gawna's nuts
Joined: Jan 28th, 2010
Gender: Male
Re: You people need to go read this
Reply #45 - Aug 21st, 2012 at 10:15pm
Print Post  
Someone has pointed out that all the ones are glancing blows, which makes it look bigger. Or something. Move along, false alarm.
  

Nilazgrc: For all those familiar with loreseekers/sentinels.... Dont run with Stainer.... Guy is a tool. Black list his toons.
kmack can drive the tractor.
The Vault donates to charity.
JDollar wrote on Apr 25th, 2013 at 4:47pm:
Stainer likes tractors
Back to top
 
IP Logged
 
scraap
Ex Member


Re: You people need to go read this
Reply #46 - Aug 21st, 2012 at 10:23pm
Print Post  
stainer wrote on Aug 21st, 2012 at 10:15pm:
Someone has pointed out that all the ones are glancing blows, which makes it look bigger. Or something. Move along, false alarm.


Doesn't explain the flat dagger curve then.

edit: Right. glancing != grazing. IRTarded.
« Last Edit: Aug 21st, 2012 at 10:25pm by »  
Back to top
 
IP Logged
 
Huginn
Korthos Resident
*
Offline


Oachkatzlschwoaf

Posts: 31
Joined: Apr 23rd, 2012
Re: You people need to go read this
Reply #47 - Aug 22nd, 2012 at 1:46am
Print Post  
twat wrote on Aug 21st, 2012 at 5:05pm:
I guess someone put this to good use


Hard to tell as those graphs were not generated by the application (they look different). Maybe he did take the exported combat log from that application, but no one can tell for sure.
  
Back to top
 
IP Logged
 
Azog
Ex Member


Re: You people need to go read this
Reply #48 - Aug 22nd, 2012 at 2:51am
Print Post  
stainer wrote on Aug 21st, 2012 at 10:15pm:
Someone has pointed out that all the ones are glancing blows, which makes it look bigger. Or something. Move along, false alarm.


Well... this one is interesting:

http://forums.ddo.com/showpost.php?p=4655865&postcount=52
Quote:
I am sure that the RNG is working properly. Turbine is only giving half of the truth when they state that. They are not detailing or even admitting what happens after that number is read. I watch my numbers closely and have had moments where I think 'Wow, I havent failed a heal scroll in awhile.' But those moments are far fewer than rolling a 1-2 up to 10 times in a row.

This 'problem' dates back to Asheron's Call where turbine used various flags, call them fate or luck flags, to further randomize a result. Not only did these flags affect you but also those around you (in a good or bad way, sometimes very good and sometimes very bad). When I last played, the effects of these flags could be repeated 100% of the time if you had two characters with drastically opposing flags. Turbine did not admit these existed (the posts might still be found on the AC forums) until the investigations behind the probably still well known 'Wi flag'. Although the Wi flag was not actually a flag but a bug between GUIDs and the hate queue the real flags were exposed and admitted.

I know this is not AC but it does relate to this game. Around 12-15 months after DDO went live I encountered a player that worked for Turbine as a developer and had just recently became unemployed (do not remember who terminated the emplotment). We started talking about AC and DDO and eventually it led to discussions of these flags. This person admitted that these flags still exist, and are still used, in DDO. They also confirmed, what I had always suspected, that the flags are based upon static data either contained in account information or character information.

The result is the random number pulled from the RNG is modified further by these flags (and perhaps by a weighting mechanic) but since static data is used they develope a rather static pattern.

Even wonder why your friend pulls multiple tomes weekly and you havent seen one in months? Ever wonder why someone has 50 bloodstones and you have only seen 1-2 with 30k undead kills on your account farming that chest? Ever wonder why a char joins your party and almost every rare in a zone pops across multiple resets and when they leave you cant find any?

This is the stuff that is broken.

« Last Edit: Aug 22nd, 2012 at 2:53am by »  
Back to top
 
IP Logged
 
Huginn
Korthos Resident
*
Offline


Oachkatzlschwoaf

Posts: 31
Joined: Apr 23rd, 2012
Re: You people need to go read this
Reply #49 - Aug 22nd, 2012 at 3:16am
Print Post  
Quote:
Well... this one is interesting:


I know a guy, who has a sister, who had a boyfriend, who hackz0red into Turbine and replaced all their RNG code to use mersenne twister with a random uniform distribution.

Quote:
Even wonder why your friend pulls multiple tomes weekly and you havent seen one in months? Ever wonder why someone has 50 bloodstones and you have only seen 1-2 with 30k undead kills on your account farming that chest? Ever wonder why a char joins your party and almost every rare in a zone pops across multiple resets and when they leave you cant find any?


I highly recommend this book.
  
Back to top
 
IP Logged
 
Page Index Toggle Pages: 1 [2] 3 
Send TopicPrint