Simple patch really, it was one of many in use back on a server I was involved with somewhat recently.
This patch auto-bans players for the most obvious speedhacking offences by ensuring speeds are "valid" (that is, faster than running and not equal to any speed [faster than run speed] in use - which, coincidentally, are the swift & lightfeet speeds [same speeds used by pots]). This approach, while 100% accurate in offence detection, is obviously limited by two things:
- users can fake actual speeds (even if they shouldn't actually be able to attain those speeds),
- the speeds sent to the server can be faked.
However, in all its time in use on the server I worked with recently, it proved to be useful. It's at least one more thing cheaters have to be careful of!- 00494D1B /E9 F1050000 JMP 00495311
- 00494D20 |90 NOP
- 00495311 894D F8 MOV DWORD PTR SS:[EBP-8],ECX ; Old patched over code.
- 00495314 8845 0B MOV BYTE PTR SS:[EBP+0B],AL
- 00495317 60 PUSHAD ; Preserve registers.
- 00495318 8B86 98800000 MOV EAX,DWORD PTR DS:[ESI+8098] ; Get _USER_DATA info.
- 0049531E 0FB678 71 MOVZX EDI,BYTE PTR DS:[EAX+71] ; Get user's Authority
- 00495322 85FF TEST EDI,EDI ; If user's a GM, ignore them.
- 00495324 74 20 JE SHORT 00495346
- 00495326 66:83FA 2D CMP DX,2D ; 45 - run speed
- 0049532A 7E 1A JLE SHORT 00495346
- 0049532C 66:83FA 43 CMP DX,43 ; 67 - swift speed
- 00495330 74 14 JE SHORT 00495346
- 00495332 66:83FA 5A CMP DX,5A ; 90 - light feet
- 00495336 74 0E JE SHORT 00495346
- 00495338 C640 71 FF MOV BYTE PTR DS:[EAX+71],0FF ; Set user's Authority to 255 (banned)
- 0049533C 89F1 MOV ECX,ESI
- 0049533E E8 18B5FFFF CALL 0049085B ; CUser::CloseProcess() - save & disconnect
- 00495343 61 POPAD ; Restore registers.
- 00495344 ^ EB C1 JMP SHORT 00495307 ; Skip function.
- 00495346 61 POPAD ; Restore registers.
- 00495347 ^ E9 D5F9FFFF JMP 00494D21 ; Return to rest of function.
Have fun. |
