PlusEmulator Exploit Fix

[Keiz]

This thread is actually retarded xD!
Such 'exploit' which you're going on about can still be done by putting

production dank hax go here

Why not use the event for the actual purpose...
Have a static variable with the build, then check the users build if not the same then disconnect the user...

I agree it should be either a static variable or not show it at all, though are you wrong

This "fix" shows every user the production they sent themselves, so unknowing normal people will see their non-hacked production, while pathetic skids see their "h4ck3d by 3l1t3Z"
edit:
they'll see "production h4cked by 3l1t3Z"

[Encode]

I can see the dislike everyone has for this fix which I released.
Next time, when I do find something, I'll be sure NOT to release to you guys lol.

[Keiz]

I can see the dislike everyone has for this fix which I released.
Next time, when I do find something, I'll be sure NOT to release to you guys lol.

Liking other options more is not the same as disliking yours.
It's a really useful fix, though are the alternatives more logical.

[iConnor]

I can see the dislike everyone has for this fix which I released.
Next time, when I do find something, I'll be sure NOT to release to you guys lol.

You guys expect to be spoon fed and then when you are, you all complain and wonder why this community is so toxic, thank you for the exploit fix Encode.

[Francis Joseph]

Regardless if its client-side or server-side, it should not be happening.

Very impressive catch!

[ovflowd]

Where is your proof that this is possible?

It's not possible IMO to change that string in whatever url the "hacker" want to like to change it.

Mackors, just need use Tanjii or other Packet Logger.

- - - Updated - - -

For me this fixes nothing. The shit continues vulnerable, unique difference it's that need start with "production" string
I can wrote something like "production for my ass"

Anyways, your fix does something good, that is change the global variable to a session variable, so only the user will se this.

Anyways, doesn't exists other way to check revision of the swf?

Cheers,

[Gaby]

Good thinking for sure. Still not an appropriate fix. Why would you want a string being send by the user (which can clearly be any string at all), to display in your :about? Even if it's just for that one user. What I suggest is the following:

GetClientVersionEvent.cs

using Plus.HabboHotel.GameClients;using Plus.Communication.Packets.Incoming;




namespace Plus.Communication.Packets.Incoming.Handshake
{
    public class GetClientVersionEvent : IPacketEvent
    {
        public void Parse(GameClient Session, ClientPacket Packet)
        {
            Packet.PopString();
        }
    }
} 

PlusEnvironment.cs

public static string SWFRevision = "PUTWHATEVERYOUWANTHERE"; 

This way you can still show something in your :about, but have ultimate control over it.

[dominic]

Good thinking for sure. Still not an appropriate fix. Why would you want a string being send by the user (which can clearly be any string at all), to display in your :about? Even if it's just for that one user. What I suggest is the following:

GetClientVersionEvent.cs

using Plus.HabboHotel.GameClients;using Plus.Communication.Packets.Incoming;




namespace Plus.Communication.Packets.Incoming.Handshake
{
    public class GetClientVersionEvent : IPacketEvent
    {
        public void Parse(GameClient Session, ClientPacket Packet)
        {
            Packet.PopString();
        }
    }
} 

PlusEnvironment.cs

public static string SWFRevision = "PUTWHATEVERYOUWANTHERE"; 

This way you can still show something in your :about, but have ultimate control over it.

Or, as others (I run multiple versions, that use the same structures, seeing as my proxy cache caches everything)
so, what I've done is like

initializeRevision(packet.popstring());

[cabeludo007]

Or, as others (I run multiple versions, that use the same structures, seeing as my proxy cache caches everything)so, what I've done is like

initializeRevision(packet.popstring());

Nice! i do the same, caching many production packets and handling at the same time and in the same server, but... I'm curious... Whats does this 'initializeRevision' function does exactly?

@Edit

My suggestion to protect your emu from some packet injection is: review your incoming handlers :)

[dominic]

Nice! i do the same, caching many production packets and handling at the same time and in the same server, but... I'm curious... Whats does this 'initializeRevision' function does exactly?

It basically just runs my packet header updater on the revision and uses those packets


Sent from my iPhone using Tapatalk

[Keiz]

@Dominic Surely interesting, I've thought about this too, yet can not figure out why one would want this.
Unless ofcourse you have REVISION & PRODUCTION support on 1 server, that'd be cool

[dominic]

@Dominic Surely interesting, I've thought about this too, yet can not figure out why one would want this.
Unless ofcourse you have REVISION & PRODUCTION support on 1 server, that'd be cool

Well, I only support PRODUCTION as of right now, however that idea might not be that bad. (and even could work, if done properly!!!)

What I use it for is that I have a proxy cache (like CloudFlare or whatever) that caches my .swf's, so whenever I update my revision; it's still stuck for some. I found the best way was to initialize different revisions

[Jonteh]

Why not use the event for the actual purpose...
Have a static variable with the build, then check the users build if not the same then disconnect the user...

Best reply so far.

- - - Updated - - -

What I use it for is that I have a proxy cache (like CloudFlare or whatever) that caches my .swf's, so whenever I update my revision; it's still stuck for some. I found the best way was to initialize different revisions

I guess you haven't heard of "Clear CF Cache" or similar features available on ALL CDN providers.

[dominic]

Best reply so far.

- - - Updated - - -



I guess you haven't heard of "Clear CF Cache" or similar features available on ALL CDN providers.

I'm lazy, I don't want to keep pressing clear cache; therefore I did how I did


Sent from my iPhone using Tapatalk

[SuklaaVene]

@Dominic Surely interesting, I've thought about this too, yet can not figure out why one would want this.
Unless ofcourse you have REVISION & PRODUCTION support on 1 server, that'd be cool

I have done this long time ago :) https://gyazo.com/b7a3b9ed6023ee0ea5bb30872386fc2e

EDIT: Also supports new ui but I dont have gif for it