Printable View
Hello, my name is Orin, I'm administrator MilleniumPK www.milleniumpk.com.br
I am looking for an anti-hacker to my server, I have the Excalibur, the more it is not currently running.
Could someone post an anti-hacker who kick and ban IP
Thanks
gm_orin@hotmail.com
GOOGLE TRANSLATE -> BRAZIL
What kind of hacks you talking about?there is a guide in guide section about that check it.
InjectorQuote:
Originally Posted by tnrh1
download PeerBlock
www.peerblock.com/releases
also check my full guide to server secruity -
http://forum.ragezone.com/f562/guide...curity-651204/
Those don't answer his problem... he is looking for something like XTrap, GameGuard or nProtect.
The solution must exist as a kernel level driver / debugger to be effective. DEP is the best start point, and if you interface with DEP you can then track anything... trouble is MS don't enable it by default on Workstation OS (XP, Vista, Windows 7) and asking cheaters to do so for you is a bit much.
Creating a kernel level defence driver is easy enough, except, you need one for 9x (.VXD) one for NT4 - XP (.SYS) and one for Vista or greater which must be UMDF compliant and pass MS verification signing, which means your driver must be debugged and passed as safe by Microsoft and given their VeriSign signature... otherwise your players can't install it unless the push their system to boot in debug mode. Asking cheaters to do that is also beyond reasonable, and getting that authorisation from Microsoft costs any developer an awful lot of money, and becomes impractical unless you are selling at least as many units as (for example) ArcSoft and making a good profit on each one.
What we are talking about requires you to have a DDK license and partnership deal with MS.
So, let's assume you can't go as far as XTrap and DEP then... what can you do? Well injection has to be achieved via Debugging methods, if you can prevent your client loading in Olly, or SoftICE then you are half way there. Now you can write your own Debugging APIs into your client and catch memory writes using the INT 3 system and disallow writes to your game.exe from code outside your game.exe.
I have no interest in doing such a thing.
The other alternative is to ensure that you do not add code or data outside the sections of the game already checked by the check_func routines in the game, and you server will disconnect injectors which affect the tables and such... but that can be faked or disabled.
Now.. I take it you are looking to do this because you run a PVP / PK server, and the only eay that is ever fun is if you are pitting your cheats against someone elses, and you'd rather your players didn't enjoy constantly being killed by their friends... Yes? (I know PvP is popular in Brazil, I just don't see how it's fun if it's fair, as PT doesn't require player skill, it's just stats and luck.) Anyway... have you considered distributing a Windows PE (Pre-installation Environment) disc image that your players can boot straight into game from?
The reason I ask is that as long as your game runs on their OS they have the high ground in this battle, and can defeat anything you can do... if you provide the OS, they don't have Admin rights on it, they can't change the OS debugger, or enable or disable in-built OS security checks; you can win. You can enable DEP in your WinPE, you can disable Driver Signing and gain Kernel level control... you can modify the Kernel it's self if you want, and certainly remove the DLL injection APIs that Windows normally provides. They don't get a choice.
Okay... so it turns a PC into a Playstation 2... but it is fair.
Bob,
He said on his first post : "Could someone post an anti-hacker who kick and ban IP"
PeerBlock bans IP and kick.
No, "kick and ban ip" he mean when someone using hacks its ban him automaticlly so no, there is no software like this but like smexy said you can do it manually with the perrblock.
Or as gregoo said, use a Log Reader and make it work with peerblock
Actually I wanted something like PTProtector or Excalibur, I currently use the PTPROTECTOR more turn he did not kick the hackers, but the Excalibur, where I changed my host stopped working.
GOOGLE TRANSLATE -> BRAZIL
probally because you need configure the PTProtector and the Excalibur to current host settings. like Path folder and so on. check in both the settings. you also need to have ODBC working on current host or the PTProtector won't work.
But PeerBlock is fast&easy to use and ban ips and range ips immaitly.
Could you add me on msn?Quote:
Originally Posted by SmexyBoyR
gm_orin@hotmail.com
"Or as gregoo said, use a Log Reader and make it work with peerblock" how~!?!@?!?@?
I dont know how. I just know its possible. Probally bobsobol/gregoo know how
Yes he did, then he said to block against injections... That has to be done client side, and a client can't ban it's self. XDQuote:
Originally Posted by SmexyBoyR
And as I said, you have to manually refresh PeerBlocks IP block list, it has no import and update API or automation facilities...Quote:
Originally Posted by SmexyBoyR
You can make a log checker write out to PeerBlock list files, and then click the button to update it's internal memory list once a day or so. :s So as Imri says, it's not really an "automatic" solution.
If you run a keyboard and mouse macro program like AutoIt or AutoHotkey, you can make them perform this operation periodically, but then you really shouldn't EVER touch your Admin login, or you could do all sorts of nasty things. XD (like, accidentally shut down your server without warning by reading a readme.txt file. :S)
PTProtector is about the best solution I know of short of Quantums "PTBastard" program... but you really need to rewrite/reconfigure it for the kind of hacks you see in your logs. Nothing server side can protect against injection... nothing client side can truly protect against it, except forcing people to boot off a CD with a secure OS.
What can prevent it? Other than not using Windows...? Not a lot. Code injection is a key platform for Windows design principals. DEP is a hardware security lock built into the CPU to stop it dead, but it's hard to implement it in Windows without breaking key features like ActiveX, DirectX, Themes, DWM etc. Because they all use injection to override the older APIs. Microsofts' solution (XP SP2 +) is good, but they have to disable it for all but core OS files because of the vast number of applications which use injection the way Microsoft have, taking their lead as an avocation of it's use. (Something heavily frowned upon in other OS.)
My last solution was to insert a global system hook to ban the creation of any new process or thread which is not part of PT, scan the process list and unload (kill task / process / thread or "Force Quit", which ever your prefer) anything that isn't part of the standard OS, mount the entire game from an encrypted virtual file system, (like mounting an ISO) then launch the game. This way no injector can be launched after the game, and if it tried to launch the game it's self, it will be killed from the process list and unloaded from memory before the game starts.
This became impractical after Vista, because it relied on a kernel level system driver which now requires Microsoft VeriSign authentication, and even then, will throw up a million and one warnings that you should update to a user-mode driver to keep your system stable... but it won't work under the User-Mode Driver Framework, because I'm specifically trying to filter the Executive Kernel. XD Kicked ass under 2K or XP though. :wink:
Without it, you are left to "guestimate" who is hacking and ban their arses... you already have the most powerful tool to do that, you just need to configure it properly. :wink:
The graphic level of PristonTale suggests a Playstation 1, or a Nintendo 64, definitely not a Playstation 2 :):Quote:
Originally Posted by bobsobol
As for the peerblock list update. You can write inside a list the IP/range to be banned, and tell your server to "stop answering" (notice the quotes) the IP until you refreshed the list cache.
Since it would be way to easy to give you directly a solution, I'm just going to give you hints.
1. It's a really nasty method
2. It involves a command prompt (which is good for automation since you can fire a cmd command from pretty much every language)
3. It involves a static route
4. It involves the loopback interface
5. If your own IP is caught into the process you won't be able to access the host anymore :lol:
Have fun :ott1: .
This is why you add yourself, and another "known good" IP to the Allow list :wink:Quote:
Originally Posted by Gregoory
I wish the documentation on PeerBlock was better. I can't see anything that says you can pass information on the command line... I'll keep digging.
Yes, on older versions of Windows you could add an IP alias to %windir%\Drivers\etc\hosts and point it to 127.0.0.1 and that would effectively block all access to or from that IP... but it's kind of a glitch in LanManager that allows that IMS. I think SMB sees the IP as being a PC on your LAN (not good for security at all) but then tries to resolve it's IP (from the IP... this is the glitch) and the internal cache says it is 127.0.0.1, and your PC happily talks to it's self... getting no sensible answer, it usually hangs up. XD
Don't know if that still works on newer OS though.
You might want to try and read my post again, since I've never mentionned passing commands to peerblock (making your reference to an allow list pointless) :] .Quote:
Originally Posted by bobsobol
I said muting IPs until you refresh peerblock's cache. This action (refreshing) has to be done manually as far as I know.
True... wishful thinking? XDAre we talking Server "system" or Server "Application"? I presume the former... but you can add IPs to the SQL database "baduser" with some versions of the dreaded SQL.dll I believe.Quote:
tell your server to "stop answering"
There are other means of filtering TCP/IP communication with a file... a Firewall (like PeerBlock) is the most common, but a gateway application, or server is another. Many NAT Routers (which perform Gateway functionality internally) can be programmed to block IPs via their web interface... this can easily be scripted via cURL / lib.cURL. You would need a different script for each router and each firmware revision however, and in any case, most of you rent a Dedi, and aren't given access to it's Router. XD
Systems like Squid or DeleGate are programmed via lists (like PeerBlock) and can be told to refresh their list data while running... Squid also has built-in web interfaces for live filter update. ^^
To make these work, you proxy your true server to the Gateway system (program or machine), and users then connect to that. Use your regular firewall to ensure that the true servers game port is not accessible from outside, so users can only connect via the proxy, and ensure that the gateway proxy passes on the TCP/IP headers containing the true users IP and, or MAC for return communications... Some "cheap" firewalls may block this communication... bad news, because if they block traffic from a safe IP which has the header of a bad IP, they may allow traffic from a bad IP with the header of a safe one. (IP spoofing)
A BSD box (even a virtual one) should have sufficient control over it's native BSD socket library (the route source of winsock.dll) to be able to act as a NAT router / firewall / gateway server without installing any "software" on top of the OS. I'm not proficient enough to give a guide on how to do that though. XD
[post removed]